From 85607a2a139f225b72ed48d8bc829902c9d22f3b Mon Sep 17 00:00:00 2001
From: "Michael B. Jones" <michael_b_jones@hotmail.com>
Date: Sun, 5 Jan 2025 21:13:37 +0000
Subject: [PATCH] Merge pull request #2209 from w3c/issue-1633-test-vectors

SHA: b36a79a8ff0f184c08d4e5b676acda0c6d5cab45
Reason: push, by selfissued

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 7176 +++++++++++++++++++++++++++++-----------------------
 1 file changed, 3951 insertions(+), 3225 deletions(-)

diff --git a/index.html b/index.html
index 23261b9d9..3f0787cb8 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <title>Web Authentication: An API for accessing Public Key Credentials - Level 3</title>
   <meta content="ED" name="w3c-status">
-  <meta content="Bikeshed version d765c696b, updated Fri Mar 8 15:58:52 2024 -0800" name="generator">
+  <meta content="Bikeshed version ac5ea272d, updated Fri Dec 6 15:45:15 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="62b069eb94a7abfd5de882a858f836ac4ec02341" name="revision">
+  <meta content="b36a79a8ff0f184c08d4e5b676acda0c6d5cab45" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -700,7 +700,7 @@
 	background-image: url(https://resources.whatwg.org/browser-logos/safari-ios.svg);
 }
 .mdn-anno > .feature > .support > .nodejs::before {
-	background-image: url(https://nodejs.org/static/images/favicons/favicon.ico);
+	background-image: url(https://nodejs.org/favicon.ico);
 }
 .mdn-anno > .feature > .support > .opera_android::before {
 	background-image: url(https://resources.whatwg.org/browser-logos/opera.svg);
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-05-20">20 May 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2025-01-05">5 January 2025</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1017,7 +1017,7 @@ <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level
     </div>
    </details>
    <div data-fill-with="warning"></div>
-   <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/policies/#copyright">Copyright</a> © 2024 <a href="https://www.w3.org/">World Wide Web Consortium</a>. <abbr title="World Wide Web Consortium">W3C</abbr><sup>®</sup> <a href="https://www.w3.org/policies/#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/policies/#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/copyright/software-license/" rel="license" title="W3C Software and Document License">permissive document license</a> rules apply. </p>
+   <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/policies/#copyright">Copyright</a> © 2025 <a href="https://www.w3.org/">World Wide Web Consortium</a>. <abbr title="World Wide Web Consortium">W3C</abbr><sup>®</sup> <a href="https://www.w3.org/policies/#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/policies/#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/copyright/software-license/" rel="license" title="W3C Software and Document License">permissive document license</a> rules apply. </p>
    <hr title="Separator for header">
   </div>
   <div class="p-summary" data-fill-with="abstract">
@@ -1047,7 +1047,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="sotd"><span class="content"
     includes instructions for disclosing a patent. An individual who has actual knowledge of a
     patent which the individual believes contains <a href="https://www.w3.org/Consortium/Patent-Policy/#def-essential">Essential
     Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/Consortium/Patent-Policy/#sec-Disclosure">section 6 of the <abbr title="World Wide Web Consortium">W3C</abbr> Patent Policy</a>. </p>
-   <p> This document is governed by the <a href="https://www.w3.org/2023/Process-20231103/" id="w3c_process_revision">03 November 2023 W3C Process Document</a>. </p>
+   <p> This document is governed by the <a href="https://www.w3.org/policies/process/20231103/" id="w3c_process_revision">03 November 2023 W3C Process Document</a>. </p>
    <p></p>
   </div>
   <div data-fill-with="at-risk"></div>
@@ -1103,18 +1103,31 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
        <ol class="toc">
         <li><a href="#sctn-credentialcreationoptions-extension"><span class="secno">5.1.1</span> <span class="content"><code>CredentialCreationOptions</code> Dictionary Extension</span></a>
         <li><a href="#sctn-credentialrequestoptions-extension"><span class="secno">5.1.2</span> <span class="content"><code>CredentialRequestOptions</code> Dictionary Extension</span></a>
-        <li><a href="#sctn-createCredential"><span class="secno">5.1.3</span> <span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span></a>
         <li>
-         <a href="#sctn-getAssertion"><span class="secno">5.1.4</span> <span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span></a>
+         <a href="#sctn-createCredential"><span class="secno">5.1.3</span> <span class="content">Create a New Credential - PublicKeyCredential’s <span><code>[[Create]](origin, options, sameOriginWithAncestors)</code></span> Internal Method</span></a>
          <ol class="toc">
-          <li><a href="#sctn-discover-from-external-source"><span class="secno">5.1.4.1</span> <span class="content">PublicKeyCredential’s <code><span><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></span></code> Method</span></a>
+          <li><a href="#sctn-create-request-exceptions"><span class="secno">5.1.3.1</span> <span class="content">Create Request Exceptions</span></a>
+         </ol>
+        <li>
+         <a href="#sctn-getAssertion"><span class="secno">5.1.4</span> <span class="content">Use an Existing Credential to Make an Assertion</span></a>
+         <ol class="toc">
+          <li><a href="#sctn-discover-from-external-source"><span class="secno">5.1.4.1</span> <span class="content">PublicKeyCredential’s <code><span><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></span></code> Internal Method</span></a>
           <li><a href="#sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2</span> <span class="content"><span class="algorithm" data-algorithm="Issuing a credential request to an authenticator">Issuing a Credential Request to an Authenticator</span></span></a>
+          <li><a href="#sctn-get-request-exceptions"><span class="secno">5.1.4.3</span> <span class="content">Get Request Exceptions</span></a>
          </ol>
-        <li><a href="#sctn-storeCredential"><span class="secno">5.1.5</span> <span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span></a>
+        <li><a href="#sctn-storeCredential"><span class="secno">5.1.5</span> <span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Internal Method</span></a>
         <li><a href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.6</span> <span class="content">Availability of <span>User-Verifying Platform Authenticator</span> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span></a>
         <li><a href="#sctn-getClientCapabilities"><span class="secno">5.1.7</span> <span class="content">Availability of <span>client</span> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span></a>
         <li><a href="#sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8</span> <span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span></a>
         <li><a href="#sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9</span> <span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span></a>
+        <li>
+         <a href="#sctn-signal-methods"><span class="secno">5.1.10</span> <span class="content">Signal Credential Changes to the Authenticator - PublicKeyCredential’s <span>signal methods</span></span></a>
+         <ol class="toc">
+          <li><a href="#sctn-signal-methods-async-rp-id-validation"><span class="secno">5.1.10.1</span> <span class="content"><span>Asynchronous RP ID validation algorithm</span></span></a>
+          <li><a href="#sctn-signalUnknownCredential"><span class="secno">5.1.10.2</span> <span class="content"><code class="idl"><span>signalUnknownCredential(options)</span></code></span></a>
+          <li><a href="#sctn-signalAllAcceptedCredentials"><span class="secno">5.1.10.3</span> <span class="content"><code class="idl"><span>signalAllAcceptedCredentials(options)</span></code></span></a>
+          <li><a href="#sctn-signalCurrentUserDetails"><span class="secno">5.1.10.4</span> <span class="content"><code class="idl"><span>signalCurrentUserDetails(options)</span></code></span></a>
+         </ol>
        </ol>
       <li>
        <a href="#iface-authenticatorresponse"><span class="secno">5.2</span> <span class="content">Authenticator Responses (interface <span><code>AuthenticatorResponse</code></span>)</span></a>
@@ -1164,10 +1177,15 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-alg-identifier"><span class="secno">5.8.5</span> <span class="content">Cryptographic Algorithm Identifier (typedef <code class="idl"><span>COSEAlgorithmIdentifier</span></code>)</span></a>
         <li><a href="#enum-userVerificationRequirement"><span class="secno">5.8.6</span> <span class="content">User Verification Requirement Enumeration (enum <span><code>UserVerificationRequirement</code></span>)</span></a>
         <li><a href="#enum-clientCapability"><span class="secno">5.8.7</span> <span class="content">Client Capability Enumeration (enum <span><code>ClientCapability</code></span>)</span></a>
-        <li><a href="#enum-hints"><span class="secno">5.8.8</span> <span class="content">User-agent Hints Enumeration (enum <span><code>PublicKeyCredentialHints</code></span>)</span></a>
+        <li><a href="#enum-hints"><span class="secno">5.8.8</span> <span class="content">User-agent Hints Enumeration (enum <span><code>PublicKeyCredentialHint</code></span>)</span></a>
        </ol>
       <li><a href="#sctn-permissions-policy"><span class="secno">5.9</span> <span class="content">Permissions Policy integration</span></a>
       <li><a href="#sctn-iframe-guidance"><span class="secno">5.10</span> <span class="content">Using Web Authentication within <code>iframe</code> elements</span></a>
+      <li>
+       <a href="#sctn-related-origins"><span class="secno">5.11</span> <span class="content">Using Web Authentication across related origins</span></a>
+       <ol class="toc">
+        <li><a href="#sctn-validating-relation-origin"><span class="secno">5.11.1</span> <span class="content">Validating Related Origins</span></a>
+       </ol>
      </ol>
     <li>
      <a href="#sctn-authenticator-model"><span class="secno">6</span> <span class="content">WebAuthn <span>Authenticator Model</span></span></a>
@@ -1198,7 +1216,12 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li>
        <a href="#sctn-strings"><span class="secno">6.4</span> <span class="content">String Handling</span></a>
        <ol class="toc">
-        <li><a href="#sctn-strings-truncation"><span class="secno">6.4.1</span> <span class="content">String Truncation</span></a>
+        <li>
+         <a href="#sctn-strings-truncation"><span class="secno">6.4.1</span> <span class="content">String Truncation</span></a>
+         <ol class="toc">
+          <li><a href="#sctn-strings-truncation-client"><span class="secno">6.4.1.1</span> <span class="content">String Truncation by Clients</span></a>
+          <li><a href="#sctn-strings-truncation-authenticator"><span class="secno">6.4.1.2</span> <span class="content">String Truncation by Authenticators</span></a>
+         </ol>
         <li><a href="#sctn-strings-langdir"><span class="secno">6.4.2</span> <span class="content">Language and Direction Encoding</span></a>
        </ol>
       <li>
@@ -1228,7 +1251,8 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li>
        <a href="#sctn-packed-attestation"><span class="secno">8.2</span> <span class="content">Packed Attestation Statement Format</span></a>
        <ol class="toc">
-        <li><a href="#sctn-packed-attestation-cert-requirements"><span class="secno">8.2.1</span> <span class="content">Packed Attestation Statement Certificate Requirements</span></a>
+        <li><a href="#sctn-packed-attestation-cert-requirements"><span class="secno">8.2.1</span> <span class="content">Certificate Requirements for Packed Attestation Statements</span></a>
+        <li><a href="#sctn-enterprise-packed-attestation-cert-requirements"><span class="secno">8.2.2</span> <span class="content">Certificate Requirements for Enterprise Packed Attestation Statements</span></a>
        </ol>
       <li>
        <a href="#sctn-tpm-attestation"><span class="secno">8.3</span> <span class="content">TPM Attestation Statement Format</span></a>
@@ -1267,28 +1291,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#prf-extension"><span class="secno">10.1.4</span> <span class="content">Pseudo-random function extension (<span>prf</span>)</span></a>
         <li><a href="#sctn-large-blob-extension"><span class="secno">10.1.5</span> <span class="content">Large blob storage extension (<span>largeBlob</span>)</span></a>
        </ol>
-      <li>
-       <a href="#sctn-defined-authenticator-extensions"><span class="secno">10.2</span> <span class="content">Authenticator Extensions</span></a>
-       <ol class="toc">
-        <li><a href="#sctn-uvm-extension"><span class="secno">10.2.1</span> <span class="content"><span>User Verification Method</span> Extension (uvm)</span></a>
-        <li>
-         <a href="#sctn-supplemental-public-keys-extension"><span class="secno">10.2.2</span> <span class="content">Supplemental public keys extension (<span>supplementalPubKeys</span>)</span></a>
-         <ol class="toc">
-          <li><a href="#sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.2.1</span> <span class="content">Relying Party Usage</span></a>
-          <li>
-           <a href="#sctn-supplemental-public-keys-extension-definition"><span class="secno">10.2.2.2</span> <span class="content">Extension Definition</span></a>
-           <ol class="toc">
-            <li><a href="#sctn-supplemental-public-keys-attestation-aaguid"><span class="secno">10.2.2.2.1</span> <span class="content">AAGUIDs</span></a>
-            <li><a href="#sctn-supplemental-public-keys-attestation-calculations"><span class="secno">10.2.2.2.2</span> <span class="content">Attestation calculations</span></a>
-           </ol>
-          <li>
-           <a href="#sctn-supplemental-public-keys-extension-verification"><span class="secno">10.2.2.3</span> <span class="content"><code>supplementalPubKeys</code> Extension Output Verification Procedures</span></a>
-           <ol class="toc">
-            <li><a href="#sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.2.3.1</span> <span class="content">Registration (<code>create()</code>)</span></a>
-            <li><a href="#sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.2.3.2</span> <span class="content">Authentication (<code>get()</code>)</span></a>
-           </ol>
-         </ol>
-       </ol>
+      <li><a href="#sctn-defined-authenticator-extensions"><span class="secno">10.2</span> <span class="content">Authenticator Extensions</span></a>
      </ol>
     <li>
      <a href="#sctn-automation"><span class="secno">11</span> <span class="content">User Agent Automation</span></a>
@@ -1374,7 +1377,39 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
      <ol class="toc">
       <li><a href="#sctn-timeout-recommended-range"><span class="secno">15.1</span> <span class="content">Recommended Range for Ceremony Timeouts</span></a>
      </ol>
-    <li><a href="#sctn-acknowledgements"><span class="secno">16</span> <span class="content">Acknowledgements</span></a>
+    <li>
+     <a href="#sctn-test-vectors"><span class="secno">16</span> <span class="content">Test Vectors</span></a>
+     <ol class="toc">
+      <li>
+       <a href="#sctn-test-vectors-attestation-root-cert"><span class="secno">16.1</span> <span class="content">Attestation trust root certificate</span></a>
+       <ol class="toc">
+        <li><a href="#sctn-test-vectors-none-es256"><span class="secno">16.1.1</span> <span class="content">ES256 Credential with No Attestation</span></a>
+        <li><a href="#sctn-test-vectors-packed-self-es256"><span class="secno">16.1.2</span> <span class="content">ES256 Credential with Self Attestation</span></a>
+        <li><a href="#sctn-test-vectors-none-es256-crossOrigin"><span class="secno">16.1.3</span> <span class="content">ES256 Credential with "crossOrigin": true in clientDataJSON</span></a>
+        <li><a href="#sctn-test-vectors-none-es256-topOrigin"><span class="secno">16.1.4</span> <span class="content">ES256 Credential with "topOrigin" in clientDataJSON</span></a>
+        <li><a href="#sctn-test-vectors-none-es256-long-credential-id"><span class="secno">16.1.5</span> <span class="content">ES256 Credential with very long credential ID</span></a>
+        <li><a href="#sctn-test-vectors-packed-es256"><span class="secno">16.1.6</span> <span class="content">Packed Attestation with ES256 Credential</span></a>
+        <li><a href="#sctn-test-vectors-packed-es384"><span class="secno">16.1.7</span> <span class="content">Packed Attestation with ES384 Credential</span></a>
+        <li><a href="#sctn-test-vectors-packed-es512"><span class="secno">16.1.8</span> <span class="content">Packed Attestation with ES512 Credential</span></a>
+        <li><a href="#sctn-test-vectors-packed-rs256"><span class="secno">16.1.9</span> <span class="content">Packed Attestation with RS256 Credential</span></a>
+        <li><a href="#sctn-test-vectors-packed-ed25519"><span class="secno">16.1.10</span> <span class="content">Packed Attestation with Ed25519 Credential</span></a>
+        <li><a href="#sctn-test-vectors-tpm-es256"><span class="secno">16.1.11</span> <span class="content">TPM Attestation with ES256 Credential</span></a>
+        <li><a href="#sctn-test-vectors-android-key-es256"><span class="secno">16.1.12</span> <span class="content">Android Key Attestation with ES256 Credential</span></a>
+        <li><a href="#sctn-test-vectors-apple-es256"><span class="secno">16.1.13</span> <span class="content">Apple Anonymous Attestation with ES256 Credential</span></a>
+        <li><a href="#sctn-test-vectors-fido-u2f-es256"><span class="secno">16.1.14</span> <span class="content">FIDO U2F Attestation with ES256 Credential</span></a>
+       </ol>
+      <li>
+       <a href="#test-vectors-extensions"><span class="secno">16.2</span> <span class="content">Test Vectors for <span>WebAuthn Extensions</span></span></a>
+       <ol class="toc">
+        <li>
+         <a href="#test-vectors-extensions-prf"><span class="secno">16.2.1</span> <span class="content">Pseudo-random function extension (prf)</span></a>
+         <ol class="toc">
+          <li><a href="#test-vectors-extensions-prf-webauthn"><span class="secno">16.2.1.1</span> <span class="content">Web Authentication API</span></a>
+          <li><a href="#test-vectors-extensions-prf-ctap"><span class="secno">16.2.1.2</span> <span class="content">CTAP2 <code>hmac-secret</code> extension</span></a>
+         </ol>
+       </ol>
+     </ol>
+    <li><a href="#sctn-acknowledgements"><span class="secno">17</span> <span class="content">Acknowledgements</span></a>
     <li>
      <a href="#index"><span class="secno"></span> <span class="content">Index</span></a>
      <ol class="toc">
@@ -1388,7 +1423,6 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li><a href="#informative"><span class="secno"></span> <span class="content">Informative References</span></a>
      </ol>
     <li><a href="#idl-index"><span class="secno"></span> <span class="content">IDL Index</span></a>
-    <li><a href="#issues-index"><span class="secno"></span> <span class="content">Issues Index</span></a>
    </ol>
   </nav>
   <main>
@@ -1597,7 +1631,7 @@ <h3 class="heading settled" data-level="1.3" id="sctn-sample-scenarios"><span cl
    <p><em>This section is not normative.</em></p>
    <p>In this section, we walk through some events in the lifecycle of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦">public key credential</a>, along with the corresponding
 sample code for using this API. Note that this is an example flow and does not limit the scope of how the API can be used.</p>
-   <p>As was the case in earlier sections, this flow focuses on a use case involving a <a data-link-type="dfn" href="#first-factor-roaming-authenticator" id="ref-for-first-factor-roaming-authenticator">first-factor roaming authenticator</a> with its own display. One example of such an authenticator would be a smart phone. Other authenticator types are also supported
+   <p>As was the case in earlier sections, this flow focuses on a use case involving a <a data-link-type="dfn" href="#passkey-roaming-authenticator" id="ref-for-passkey-roaming-authenticator">passkey roaming authenticator</a> with its own display. One example of such an authenticator would be a smart phone. Other authenticator types are also supported
 by this API, subject to implementation by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform">client platform</a>. For instance, this flow also works without modification for the case of
 an authenticator that is embedded in the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③">client device</a>. The flow also works for the case of an authenticator without
 its own display (similar to a smart card) subject to specific implementation considerations. Specifically, the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①">client platform</a> needs to display any prompts that would otherwise be shown by the authenticator, and the authenticator needs to allow the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②">client
@@ -1636,7 +1670,7 @@ <h4 class="heading settled" data-level="1.3.1" id="sctn-sample-registration"><sp
      </ul>
    </ol>
    <p>The sample code for generating and registering a new key follows:</p>
-<pre class="example highlight" id="example-838c9f88"><a class="self-link" href="#example-838c9f88"></a><c- k>if</c-> <c- p>(</c-><c- o>!</c->window<c- p>.</c->PublicKeyCredential<c- p>)</c-> <c- p>{</c-> <c- d>/* Client not capable. Handle error. */</c-> <c- p>}</c->
+<pre class="example highlight" id="example-5f2e796a"><a class="self-link" href="#example-5f2e796a"></a><c- k>if</c-> <c- p>(</c-><c- o>!</c->window<c- p>.</c->PublicKeyCredential<c- p>)</c-> <c- p>{</c-> <c- d>/* Client not capable. Handle error. */</c-> <c- p>}</c->
 
 <c- a>var</c-> publicKey <c- o>=</c-> <c- p>{</c->
   <c- c1>// The challenge is produced by the server; see the Security Considerations</c->
@@ -1674,7 +1708,7 @@ <h4 class="heading settled" data-level="1.3.1" id="sctn-sample-registration"><sp
 
   timeout<c- o>:</c-> <c- mf>300000</c-><c- p>,</c->  <c- c1>// 5 minutes</c->
   excludeCredentials<c- o>:</c-> <c- p>[</c->
-    <c- c1>// Don’t re-register any authenticator that has one of these credentials</c->
+    <c- c1>// Don't re-register any authenticator that has one of these credentials</c->
     <c- p>{</c-><c- u>"id"</c-><c- o>:</c-> Uint8Array<c- p>.</c-><c- kr>from</c-><c- p>(</c->window<c- p>.</c->atob<c- p>(</c-><c- u>"ufJWp8YGlibm1Kd9XQBWN1WAw2jy5In2Xhon9HAqcXE="</c-><c- p>),</c-> c<c- p>=></c->c<c- p>.</c->charCodeAt<c- p>(</c-><c- mf>0</c-><c- p>)),</c-> <c- u>"type"</c-><c- o>:</c-> <c- u>"public-key"</c-><c- p>},</c->
     <c- p>{</c-><c- u>"id"</c-><c- o>:</c-> Uint8Array<c- p>.</c-><c- kr>from</c-><c- p>(</c->window<c- p>.</c->atob<c- p>(</c-><c- u>"E/e1dhZc++mIsz4f9hb6NifAzJpF1V4mEtRlIPBiWdY="</c-><c- p>),</c-> c<c- p>=></c->c<c- p>.</c->charCodeAt<c- p>(</c-><c- mf>0</c-><c- p>)),</c-> <c- u>"type"</c-><c- o>:</c-> <c- u>"public-key"</c-><c- p>}</c->
   <c- p>],</c->
@@ -1830,7 +1864,7 @@ <h4 class="heading settled" data-level="1.3.3" id="sctn-sample-authentication"><
    <h4 class="heading settled" data-level="1.3.4" id="sctn-sample-aborting"><span class="secno">1.3.4. </span><span class="content">Aborting Authentication Operations</span><a class="self-link" href="#sctn-sample-aborting"></a></h4>
    <p>The below example shows how a developer may use the AbortSignal parameter to abort a
 credential registration operation. A similar procedure applies to an authentication operation.</p>
-<pre class="example highlight" id="example-4c7ad12d"><a class="self-link" href="#example-4c7ad12d"></a><c- a>const</c-> authAbortController <c- o>=</c-> <c- ow>new</c-> AbortController<c- p>();</c->
+<pre class="example highlight" id="example-087da4b8"><a class="self-link" href="#example-087da4b8"></a><c- a>const</c-> authAbortController <c- o>=</c-> <c- ow>new</c-> AbortController<c- p>();</c->
 <c- a>const</c-> authAbortSignal <c- o>=</c-> authAbortController<c- p>.</c->signal<c- p>;</c->
 
 authAbortSignal<c- p>.</c->onabort <c- o>=</c-> <c- a>function</c-> <c- p>()</c-> <c- p>{</c->
@@ -1848,8 +1882,8 @@ <h4 class="heading settled" data-level="1.3.4" id="sctn-sample-aborting"><span c
         <c- c1>// Register the user.</c->
     <c- p>}).</c-><c- k>catch</c-><c- p>(</c-><c- a>function</c-> <c- p>(</c->error<c- p>)</c-> <c- p>{</c->
         <c- k>if</c-> <c- p>(</c->error <c- o>==</c-> <c- u>"AbortError"</c-><c- p>)</c-> <c- p>{</c->
-            <c- c1>// Inform user the credential hasn’t been created.</c->
-            <c- c1>// Let the server know a key hasn’t been created.</c->
+            <c- c1>// Inform user the credential hasn't been created.</c->
+            <c- c1>// Let the server know a key hasn't been created.</c->
         <c- p>}</c->
     <c- p>});</c->
 
@@ -2092,7 +2126,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-discoverable-public-key-credential-source">Client-side discoverable Public Key Credential Source</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-discoverable-credential">Client-side discoverable Credential</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverable-credential">Discoverable Credential</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="passkey">Passkey</dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-export id="passkey">Passkey</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="resident-credential">Resident Credential</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="resident-key">Resident Key</dfn>
     <dd data-md>
@@ -2134,7 +2168,6 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-private-key">Credential Private Key</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-public-key">Credential Public Key</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-public-key">User Public Key</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-credential">User Credential</dfn>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair②">credential key pair</a> is a pair of asymmetric cryptographic keys generated by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑤">authenticator</a> and <a data-link-type="dfn" href="#scope" id="ref-for-scope⑤">scoped</a> to a specific <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥">WebAuthn Relying Party</a>. It is the central part of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①②">public key credential</a>.</p>
      <p>A <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③">credential public key</a> is the public key portion of a <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair③">credential key pair</a>.
@@ -2201,48 +2234,42 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The value of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson">clientDataJSON</a></code> attribute
 when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②④">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①②">registered</a>.
 Storing this in combination with the above <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject">attestationObject</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item②">item</a> enables the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤③">Relying Party</a> to re-verify the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①">attestation signature</a> at a later time.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</dfn>
-      <dd data-md>
-       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> description of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>.</p>
-       <p>If used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Party</a> SHOULD use this to describe the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a> in the user’s account settings.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> SHOULD allow the user to choose this value, and MAY allow the user to modify it at will.</p>
-       <p>The <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> defines the <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential property</a> <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname">authenticatorDisplayName</a></code> which, when available, MAY be offered as a default for this value.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a> MAY also derive a default value from the authenticator’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a>, if any.</p>
      </dl>
-     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
+     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
 and MAY omit any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑤">items</a> not needed for their implementation.</p>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-descriptor-for-a-credential-record">credential descriptor for a credential record</dfn> is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a></code> value with the contents:</p>
      <dl>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type">type</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id">id</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①">transports</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
      </dl>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplemental-public-key">Supplemental public key</dfn>
-    <dd data-md>
-     <p>A additional public key, associated with a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential">user credential</a>, that can be obtained (and exercised) with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys">supplementalPubKeys</a> extension. These public keys provide more specific continuity signals. For example, a supplemental public key with <code>device</code> scope never leaves the device, while a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credential</a> can. Other supplemental public keys might have a broader scope, as described by their <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attestation</a>.</p>
-     <p>Supplemental public keys MUST NOT have a scope that exceeds the scope of their <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>—i.e. they never link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credentials</a> together. While this specification defines norms around scopes, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Parties</a> have to evaluate supplemental public keys in light of their <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a>, if any, and assign credibility to claimed scopes accordingly.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="generating-authenticator">Generating Authenticator</dfn>
     <dd data-md>
      <p>The Generating Authenticator is the authenticator involved in the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①">authenticatorMakeCredential</a> operation resulting
-in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credentials</a>, the generating authenticator may or may not be the same as the
+in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the
 current <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑧">managing authenticator</a> participating in a given <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑤">authentication</a> operation.</p>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="human-palatability">Human Palatability</dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="human palatability|human-palatable" data-noexport id="human-palatability">Human Palatability</dfn>
     <dd data-md>
-     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> is intended to be rememberable and reproducible by typical human
+     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> is intended to be rememberable and reproducible by typical human
 users, in contrast to identifiers that are, for example, randomly generated sequences of bits <a data-link-type="biblio" href="#biblio-edupersonobjectclassspec" title="EduPerson">[EduPersonObjectClassSpec]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-discoverable-credential">Non-Discoverable Credential</dfn>
     <dd data-md>
      <p>This is a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③">credential</a> whose <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①①">credential ID</a> must be provided in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②">allowCredentials</a></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④">navigator.credentials.get()</a></code> because it is not <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential④">client-side discoverable</a>. See also <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential②">server-side credentials</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registrable-origin-label">Registrable Origin Label</dfn>
+    <dd data-md>
+     <p>The first <a data-link-type="dfn" href="https://url.spec.whatwg.org/#domain-label" id="ref-for-domain-label">domain label</a> of the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain">registrable domain</a> of a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a>,
+or null if the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain①">registrable domain</a> is null.
+For example, the <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label">registrable origin label</a> of both <code>example.co.uk</code> and <code>www.example.de</code> is <code>example</code> if both <code>co.uk</code> and <code>de</code> are <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-public-suffix" id="ref-for-host-public-suffix">public suffixes</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential">Public Key Credential</dfn>
     <dd data-md>
-     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, the
-possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
+     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>, the
+possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
      <div class="note" role="note">
        Note: This is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#willful-violation" id="ref-for-willful-violation">willful violation</a> of <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. In English, a "credential" is both a) the thing presented to prove
     a statement and b) intended to be used multiple times. It’s impossible to achieve both criteria securely with a single
@@ -2252,7 +2279,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
       <dl>
        <dt data-md>"Authentication information" (possibly including a private key)
        <dd data-md>
-        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">Public key credential source</a></p>
+        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">Public key credential source</a></p>
        <dt data-md>"Signed value"
        <dd data-md>
         <p><a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion④">Authentication assertion</a></p>
@@ -2261,12 +2288,12 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
         <p><a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑧">Credential public key</a> or <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②">attestation object</a></p>
       </dl>
      </div>
-     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
-Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> uses its stored
+     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
+Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a> uses its stored
 copy of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⓪">credential public key</a> to verify the resultant <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑤">authentication assertion</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential-source">Public Key Credential Source</dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
+     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-type">type</dfn>
       <dd data-md>
@@ -2279,20 +2306,20 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key④">credential private key</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-rpid">rpId</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
+       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
 This is determined by the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id">id</a></code></code> parameter of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①">create()</a></code> operation.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-userhandle">userHandle</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
+       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
 nullable, however <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②">user handle</a> MUST always be populated for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②">discoverable credentials</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-otherui">otherUI</dfn>
       <dd data-md>
-       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
+       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
      </dl>
-     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
+     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
 credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-managing-authenticator">managing authenticator</dfn> and returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①①">credential public key</a> associated with its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑤">credential
-private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
-this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a>.</p>
+private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
+this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rate-limiting">Rate Limiting</dfn>
     <dd data-md>
      <p>The process (also known as throttling) by which an authenticator implements controls against brute force attacks by limiting
@@ -2303,25 +2330,25 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration">Registration</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration-ceremony">Registration Ceremony</dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
+     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
 Note that this includes employing a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence②">test of user presence</a> or <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑦">user verification</a>.
 After a successful <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②">registration ceremony</a>, the user can be authenticated by an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥">authentication ceremony</a>.</p>
      <p>The WebAuthn <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③">registration ceremony</a> is defined in <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
+and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
 with a <code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey">publicKey</a></code> argument.
 See <a href="#sctn-api">§ 5 Web Authentication API</a> for an introductory overview and <a href="#sctn-sample-registration">§ 1.3.1 Registration</a> for implementation examples.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party">Relying Party</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-relying-party">WebAuthn Relying Party</dfn>
     <dd data-md>
      <p>The entity whose <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-application">web application</dfn> utilizes the <a href="#sctn-api">Web Authentication API</a> to <a data-link-type="dfn" href="#registration" id="ref-for-registration①④">register</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑦">authenticate</a> users.</p>
-     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> implementation typically consists of both some client-side script
+     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> implementation typically consists of both some client-side script
 that invokes the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑦">Web Authentication API</a> in the <a data-link-type="dfn" href="#client" id="ref-for-client①④">client</a>,
 and a server-side component that executes the <a href="#sctn-rp-operations">Relying Party operations</a> and other application logic.
 Communication between the two components MUST use HTTPS or equivalent transport security,
 but is otherwise beyond the scope of this specification.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> in one
-    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
-    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
+     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> in one
+    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
+    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
     a WebAuthn context may be embedded in a broader overall context, e.g., one based on OAuth.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party-identifier">Relying Party Identifier</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rp-id">RP ID</dfn>
@@ -2330,9 +2357,9 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
      <p>By default, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④">RP ID</a> for a
 WebAuthn operation is set to the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain">effective domain</a>. This default MAY be
 overridden by the caller, as long as the caller-specified <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤">RP ID</a> value <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal
-to</a> the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①">effective domain</a>. See also <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> and <a href="#sctn-getAssertion">§ 5.1.4 Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>.</p>
+to</a> the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①">effective domain</a>. See also <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Internal Method</a> and <a href="#sctn-getAssertion">§ 5.1.4 Use an Existing Credential to Make an Assertion</a>.</p>
      <div class="note" id="note-pkcredscope" role="note">
-      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host" id="ref-for-concept-origin-host">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
+      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host" id="ref-for-concept-origin-host">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain②">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
       <ul>
        <li data-md>
         <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑧">RP ID</a> must be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain③">effective domain</a>.</p>
@@ -2347,7 +2374,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <li data-md>
         <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port②">port</a> is unrestricted.</p>
       </ul>
-      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>. Another example of a valid origin is <code>http://localhost:8000</code>, due to the origin being <code>localhost</code>.</p>
+      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>. Another example of a valid origin is <code>http://localhost:8000</code>, due to the origin being <code>localhost</code>.</p>
       <p>This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, <a data-link-type="biblio" href="#biblio-rfc6265" title="HTTP State Management Mechanism">[RFC6265]</a>).
     Please note that this is a greater relaxation of "same-origin" restrictions than what <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain" id="ref-for-dom-document-domain">document.domain</a>'s setter provides.</p>
       <p>These restrictions on origin values apply to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑤">WebAuthn Clients</a>.</p>
@@ -2361,10 +2388,10 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 For backwards compatibility purposes, the various <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⓪">WebAuthn API</a> and <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model①">Authenticator Model</a> components
 with various forms of <code>resident</code> within their names have not been changed.</p>
      <p>A <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source①">Server-side Public Key Credential Source</a>, or <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential④">Server-side Credential</a> for short,
-is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a> must
+is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> must
 manage the credential’s storage and discovery, as well as be able to first identify the user in order to
 discover the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①④">credential IDs</a> to supply in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑦">navigator.credentials.get()</a></code> call.</p>
-     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
+     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
 This is in contrast to a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑤">client-side discoverable credential</a>,
 which instead does not require the user to first be identified in order to provide the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑤">credential ID</a>s
 to a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑧">navigator.credentials.get()</a></code> call.</p>
@@ -2379,27 +2406,27 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-account">User Account</dfn>
     <dd data-md>
      <p>In the context of this specification,
-a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
+a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
 This mapping, the set of credentials, and their authorizations, may evolve over time.
 A given <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑦">user account</a> might be accessed by one or more natural persons (also known as "users"),
 and one natural person might have access to one or more <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑧">user accounts</a>,
-depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a>.</p>
+depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-consent">User Consent</dfn>
     <dd data-md>
      <p>User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts.
 An <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①①">authorization gesture</a> is a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑨">ceremony</a> component often employed to indicate <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent④">user consent</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-handle">User Handle</dfn>
     <dd data-md>
-     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
+     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
      <p>The main use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle④">user handle</a> is to identify the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⓪">user account</a> in such <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑨">authentication ceremonies</a>,
 but the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑥">credential ID</a> could be used instead.
 The main differences are
 that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">authenticator</a> and is unique for each credential,
-while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a> and ought to be the same
+while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> and ought to be the same
 for all <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑤">credentials</a> registered to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①①">user account</a>.</p>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential sources</a>.
-As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a>. Therefore
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential sources</a>.
+As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>. Therefore
 a secondary use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑧">user handle</a> is to allow <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑥">authenticators</a> to know when to replace an existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credential</a> with a new one during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration ceremony</a>.</p>
      <p>A user handle is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence①">byte sequence</a> with a maximum size of 64 bytes, and is not meant to be displayed to the user.
 It MUST NOT contain personally identifying information, see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
@@ -2413,7 +2440,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 through various <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①②">authorization gesture</a> modalities; for example, through a touch plus pin code, password entry, or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition②">biometric recognition</a> (e.g., presenting a fingerprint) <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>. The intent is to
 distinguish individual users.
 See also <a href="#sctn-authentication-factor-capability">§ 6.2.3 Authentication Factor Capability</a>.</p>
-     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a> a concrete identification of the user,
+     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a> a concrete identification of the user,
 but when 2 or more ceremonies with <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①①">user verification</a> have been done with that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑥">credential</a> it expresses that it was the same user that performed all of them.
 The same user might not always be the same natural person, however,
 if multiple natural persons share access to the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑧">authenticator</a>.</p>
@@ -2434,8 +2461,8 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
    </dl>
    <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-authentication-api">Web Authentication API</dfn></span><a class="self-link" href="#sctn-api"></a></h2>
    <p>This section normatively specifies the API for creating and using <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⓪">public key credentials</a>. The basic
-idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
-browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
+idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
+browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
    <figure id="fig-registration">
      <img src="images/webauthn-registration-flow-01.svg"> 
     <figcaption>Registration Flow</figcaption>
@@ -2459,12 +2486,12 @@ <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5.
 a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin④">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
 the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
 is created as well as in all assertions produced by WebAuthn credentials.</p>
-   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
-credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
-Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> can only be used in operations
+   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
+credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
+Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a> can only be used in operations
 requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
-where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origins</a>.</p>
-   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
+where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origins</a>.</p>
+   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
 each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context">secure contexts</a>.
 For web contexts in particular,
 this only includes those accessed via a secure transport (e.g., TLS) established without errors.</p>
@@ -2500,11 +2527,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②">DOMString</a>, readonly, nullable</span>
     <dd data-md>
      <p>This attribute reports the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality">authenticator attachment modality</a> in effect at the time the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⓪">navigator.credentials.get()</a></code> methods successfully complete.
-The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Parties</a> SHOULD treat unknown values
+The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Parties</a> SHOULD treat unknown values
 as if the value were null.</p>
      <div class="note" role="note">
        Note: If, as the result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⓪">authentication ceremony</a>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment①">authenticatorAttachment</a></code>'s value is "cross-platform" and
-concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
+concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
       <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①">attachment modality</a> could change over time.
 For example, a mobile phone might at one time only support <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment">platform attachment</a> but later receive updates to support <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment">cross-platform attachment</a> as well.</p>
      </div>
@@ -2517,11 +2544,16 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 attempting to set <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①">conditional</a></code>.</p>
      <p>Upon invocation, a promise is returned that resolves with a value of <code>true</code> if <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated">user mediation</a> is available, or <code>false</code> otherwise.</p>
      <p>This method has no arguments and returns a promise to a Boolean value.</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget">conditionalGet</a></code> capability is equivalent to this promise resolving to <code>true</code>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> If this method is not present, <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional③">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated①">user mediation</a> is not available for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①②">navigator.credentials.get()</a></code>.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> This method does _not_ indicate
+whether or not <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional④">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated②">user mediation</a> is available
+in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code>.
+For that, see the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate">conditionalCreate</a></code> capability in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities">getClientCapabilities()</a></code>.</p>
     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson">toJSON()</a></code>
     <dd data-md>
      <p>This operation returns <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson">RegistrationResponseJSON</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson">AuthenticationResponseJSON</a></code>,
-which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
+which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
 but MUST take additional steps to first encode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②">ArrayBuffer</a></code> values to <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③">DOMString</a></code> values
 using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①">base64url encoding</a>.</p>
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-registrationresponsejson-clientextensionresults" id="ref-for-dom-registrationresponsejson-clientextensionresults">RegistrationResponseJSON.clientExtensionResults</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationresponsejson-clientextensionresults" id="ref-for-dom-authenticationresponsejson-clientextensionresults">AuthenticationResponseJSON.clientExtensionResults</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults①">getClientExtensionResults()</a></code>,
@@ -2538,45 +2570,45 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 <c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-object" id="ref-for-idl-object"><c- b>object</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></dfn>;
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-registrationresponsejson-id"><code><c- g>id</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-registrationresponsejson-rawid"><code><c- g>rawId</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-registrationresponsejson-id"><code><c- g>id</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-registrationresponsejson-rawid"><code><c- g>rawId</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticatorattestationresponsejson" id="ref-for-dictdef-authenticatorattestationresponsejson"><c- n>AuthenticatorAttestationResponseJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorAttestationResponseJSON" id="dom-registrationresponsejson-response"><code><c- g>response</c-></code></dfn>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-registrationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-registrationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson" id="ref-for-dictdef-authenticationextensionsclientoutputsjson"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientOutputsJSON" id="dom-registrationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-registrationresponsejson-type"><code><c- g>type</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-registrationresponsejson-type"><code><c- g>type</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorattestationresponsejson"><code><c- g>AuthenticatorAttestationResponseJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring②"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring③"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧"><c- b>DOMString</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-authenticatorattestationresponsejson-transports"><code><c- g>transports</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring②"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑨"><c- b>DOMString</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-authenticatorattestationresponsejson-transports"><code><c- g>transports</c-></code></dfn>;
     // The publicKey field will be missing if pubKeyCredParams was used to
     // negotiate a public-key algorithm that the user agent doesn't
     // understand. (See section “Easily accessing credential data” for a
     // list of which algorithms user agents must support.) If using such an
     // algorithm then the public key must be parsed directly from
     // attestationObject or authenticatorData.
-    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring④"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-publickey"><code><c- g>publicKey</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-long-long" id="ref-for-idl-long-long"><c- b>long</c-> <c- b>long</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="long long" id="dom-authenticatorattestationresponsejson-publickeyalgorithm"><code><c- g>publicKeyAlgorithm</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring③"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-publickey"><code><c- g>publicKey</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier"><c- n>COSEAlgorithmIdentifier</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="COSEAlgorithmIdentifier" id="dom-authenticatorattestationresponsejson-publickeyalgorithm"><code><c- g>publicKeyAlgorithm</c-></code></dfn>;
     // This value contains copies of some of the fields above. See
     // section “Easily accessing credential data”.
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑤"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-attestationobject"><code><c- g>attestationObject</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring④"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorattestationresponsejson-attestationobject"><code><c- g>attestationObject</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationresponsejson"><code><c- g>AuthenticationResponseJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑥"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticationresponsejson-id"><code><c- g>id</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑦"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticationresponsejson-rawid"><code><c- g>rawId</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⓪"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationresponsejson-id"><code><c- g>id</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑤"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticationresponsejson-rawid"><code><c- g>rawId</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticatorassertionresponsejson" id="ref-for-dictdef-authenticatorassertionresponsejson"><c- n>AuthenticatorAssertionResponseJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorAssertionResponseJSON" id="dom-authenticationresponsejson-response"><code><c- g>response</c-></code></dfn>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑨"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①①"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson" id="ref-for-dictdef-authenticationextensionsclientoutputsjson①"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientOutputsJSON" id="dom-authenticationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⓪"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationresponsejson-type"><code><c- g>type</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①②"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationresponsejson-type"><code><c- g>type</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorassertionresponsejson"><code><c- g>AuthenticatorAssertionResponseJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑧"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑨"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⓪"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-signature"><code><c- g>signature</c-></code></dfn>;
-    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①①"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-userhandle"><code><c- g>userHandle</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑥"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑦"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑧"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-signature"><code><c- g>signature</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑨"><c- n>Base64URLString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-authenticatorassertionresponsejson-userhandle"><code><c- g>userHandle</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputsjson"><code><c- g>AuthenticationExtensionsClientOutputsJSON</c-></code></dfn> {
@@ -2602,14 +2634,14 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 For example, an authenticator without on-board storage may create identifiers containing a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑦">credential private key</a> wrapped with a symmetric key that is burned into the authenticator.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-clientextensionsresults-slot"><code>[[clientExtensionsResults]]</code></dfn>
     <dd data-md>
-     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get()</a></code>.</p>
+     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑥">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get()</a></code>.</p>
    </dl>
    <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⓪">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object②">interface object</a> inherits <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑥">Credential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, and defines its own
 implementation of each of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-store-slot" id="ref-for-dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a></code>.</p>
    <p>Calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer">CredentialsContainer</a></code>'s <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess" id="ref-for-dom-credentialscontainer-preventsilentaccess">preventSilentAccess()</a></code> method
 will have no effect on <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①①">PublicKeyCredential</a></code> credentials, since they always require user interaction.</p>
    <h4 class="heading settled" data-level="5.1.1" id="sctn-credentialcreationoptions-extension"><span class="secno">5.1.1. </span><span class="content"><code>CredentialCreationOptions</code> Dictionary Extension</span><a class="self-link" href="#sctn-credentialcreationoptions-extension"></a></h4>
-   <p>To support registration via <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑥">navigator.credentials.create()</a></code>, this document extends
+   <p>To support registration via <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code>, this document extends
 the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions">CredentialCreationOptions</a></code> dictionary as follows:</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions①"><c- g>CredentialCreationOptions</c-></a> {
     <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions"><c- n>PublicKeyCredentialCreationOptions</c-></a>      <dfn class="dfn-paneled idl-code" data-dfn-for="CredentialCreationOptions" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialCreationOptions" id="dom-credentialcreationoptions-publickey"><code><c- g>publicKey</c-></code></dfn>;
@@ -2621,14 +2653,13 @@ <h4 class="heading settled" data-level="5.1.2" id="sctn-credentialrequestoptions
     <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions"><c- n>PublicKeyCredentialRequestOptions</c-></a>      <dfn class="dfn-paneled idl-code" data-dfn-for="CredentialRequestOptions" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialRequestOptions" id="dom-credentialrequestoptions-publickey"><code><c- g>publicKey</c-></code></dfn>;
 };
 </pre>
-   <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span class="secno">5.1.3. </span><span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-createCredential"></a></h4>
+   <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span class="secno">5.1.3. </span><span class="content">Create a New Credential - PublicKeyCredential’s <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-create-slot"><code>[[Create]](origin, options, sameOriginWithAncestors)</code></dfn> Internal Method</span><a class="self-link" href="#sctn-createCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)">
-     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="[[Create]](origin, options, sameOriginWithAncestors)" id="dom-publickeycredential-create-slot"><code>[[Create]](origin,
-options, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>. 
-    <p>By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional④">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Parties</a> can indicate that they would like to register a credential without prominent modal UI if user has already consented to create a credential. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> SHOULD first check that <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate">conditionalCreate</a></code> is present
-in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities">getClientCapabilities()</a></code> in order to avoid the possibility of causing a user-visible error to be returned if the user agent does
-not support <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated②">user mediation</a> for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code>.
-The client MUST set BOTH <var>requireUserPresence</var> and <var>requireUserVerification</var> to <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑥">conditional</a></code> unless they may explicitly performed during the ceremony.</p>
+     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>. 
+    <p>By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Parties</a> can indicate that they would like to register a credential without prominent modal UI if the user has already consented to create a credential.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities①">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate①">conditionalCreate</a></code> capability
+in order to prevent a user-visible error in case this feature is not available.
+The client MUST set BOTH <var>requireUserPresence</var> and <var>requireUserVerification</var> to <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation①">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑥">conditional</a></code> unless they may explicitly performed during the ceremony.</p>
     <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑨">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑦">internal method</a> accepts three arguments:</p>
@@ -2648,7 +2679,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
     </dl>
     <p class="note" role="note"><span class="marker">Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise②">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①①">navigator.credentials.create()</a></code>.</p>
     <p class="note" role="note"><span class="marker">Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -2658,7 +2689,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <p>If <var>sameOriginWithAncestors</var> is <code>false</code>:</p>
       <ol>
        <li data-md>
-        <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑦">conditional</a></code>:</p>
+        <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation②">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑦">conditional</a></code>:</p>
         <ol>
          <li data-md>
           <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①">DOMException</a></code></p>
@@ -2672,14 +2703,14 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
        <li data-md>
         <p><a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation" id="ref-for-consume-user-activation">Consume user activation</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global①">relevant global object</a>.</p>
       </ol>
-      <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> SHOULD make it clear to the user in the case where the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> that is creating a credential is different from the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin">top-level origin</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global②">relevant global object</a> (i.e., is a
+      <p class="note" role="note"><span class="marker">NOTE:</span> The <a data-link-type="dfn" href="#client" id="ref-for-client①⑦">client</a> SHOULD make it clear to the user in the case where the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> that is creating a credential is different from the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin">top-level origin</a> of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global" id="ref-for-concept-relevant-global②">relevant global object</a> (i.e., is a
       different origin than the user can see in the address bar).</p>
      <li data-md>
       <p>Let <var>pkOptions</var> be the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey③">publicKey</a></code></code>.</p>
      <li data-md>
       <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout">timeout</a></code></code> is present, check if its value lies within a
-reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑦">client</a> and if not, correct it to the closest value lying within that range. Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout①">timeout</a></code></code> is not
-present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client①⑧">client</a>-specific default.</p>
+reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑧">client</a> and if not, correct it to the closest value lying within that range. Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout①">timeout</a></code></code> is not
+present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client①⑨">client</a>-specific default.</p>
       <p>See the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</a> for guidance on deciding a reasonable range and default for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout②">timeout</a></code></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
      <li data-md>
@@ -2691,8 +2722,8 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
 If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑤">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain①">valid domain</a>, then throw a
 "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④">DOMException</a></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑥">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>, which can be represented in various manners,
-    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain②">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host">empty host</a>.
-    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain③">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host②">host</a> is allowed here. This is for simplification and also
+    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain③">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host">empty host</a>.
+    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain④">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host②">host</a> is allowed here. This is for simplification and also
     is in recognition of various issues with using direct IP address identification in concert
     with PKI-based security.</p>
      <li id="CreateCred-DetermineRpId">
@@ -2702,22 +2733,36 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
        <dt data-md>is present
        <dd data-md>
         <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id②">id</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to②">is not a
-registrable domain suffix of and is not equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑤">DOMException</a></code>.</p>
-       <dt data-md>Is not present
+registrable domain suffix of and is not equal to</a> <var>effectiveDomain</var>, and if the client</p>
+        <dl class="switch">
+         <dt data-md>supports <a href="#sctn-related-origins">related origin requests</a>
+         <dd data-md>
+          <ol>
+           <li data-md>
+            <p>Let <var>rpIdRequested</var> be the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp③">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id③">id</a></code></code>.</p>
+           <li data-md>
+            <p>Run the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure">related origins validation procedure</a> with arguments <var>callerOrigin</var> and <var>rpIdRequested</var>.
+If the result is <code>false</code>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑤">DOMException</a></code>.</p>
+          </ol>
+         <dt data-md>does not support <a href="#sctn-related-origins">related origin requests</a>
+         <dd data-md>
+          <p>throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑥">DOMException</a></code>.</p>
+        </dl>
+       <dt data-md>is not present
        <dd data-md>
-        <p>Set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp③">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id③">id</a></code></code> to <var>effectiveDomain</var>.</p>
+        <p>Set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp④">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id④">id</a></code></code> to <var>effectiveDomain</var>.</p>
       </dl>
-      <p class="note" role="note"><span class="marker">Note:</span> <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp④">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id④">id</a></code></code> represents the
-        caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑦">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑧">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin③">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑦">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑤">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑤">id</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">create()</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑤">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑤">id</a></code></code> represents the
+        caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑦">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑧">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin③">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑦">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑥">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑥">id</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">create()</a></code>.</p>
      <li data-md>
       <p>Let <var>credTypesAndPubKeyAlgs</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①">items</a> are pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①">PublicKeyCredentialType</a></code> and
-a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier">COSEAlgorithmIdentifier</a></code>.</p>
+a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①">COSEAlgorithmIdentifier</a></code>.</p>
      <li data-md>
       <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams">pubKeyCredParams</a></code></code>’s <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size">size</a></p>
       <dl class="switch">
        <dt data-md>is zero
        <dd data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append">Append</a> the following pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype②">PublicKeyCredentialType</a></code> and <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①">COSEAlgorithmIdentifier</a></code> values to <var>credTypesAndPubKeyAlgs</var>:</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append">Append</a> the following pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype②">PublicKeyCredentialType</a></code> and <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier②">COSEAlgorithmIdentifier</a></code> values to <var>credTypesAndPubKeyAlgs</var>:</p>
         <ul>
          <li data-md>
           <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key①">public-key</a></code> and <code>-7</code> ("ES256").</p>
@@ -2736,7 +2781,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append①">Append</a> the pair of <code><var>current</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type①">type</a></code></code> and <var>alg</var> to <var>credTypesAndPubKeyAlgs</var>.</p>
         </ol>
-        <p>If <var>credTypesAndPubKeyAlgs</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty②">is empty</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑥">DOMException</a></code>.</p>
+        <p>If <var>credTypesAndPubKeyAlgs</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty②">is empty</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑦">DOMException</a></code>.</p>
       </dl>
      <li data-md>
       <p>Let <var>clientExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①">map</a> and let <var>authenticatorExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map②">map</a>.</p>
@@ -2766,13 +2811,13 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin">origin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin">serialization of</a> <var>callerOrigin</var>.</p>
+       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin">crossOrigin</a></code>
+       <dd data-md>
+        <p>The inverse of the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑨">internal method</a>.</p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin">topOrigin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin①">serialization of</a> <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin①">top-level origin</a> if
-the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑨">internal method</a> is <code>false</code>, else <code>undefined</code>.</p>
-       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin">crossOrigin</a></code>
-       <dd data-md>
-        <p>The inverse of the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors①">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⓪">internal method</a>.</p>
+the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors①">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⓪">internal method</a> is <code>false</code>, else <code>undefined</code>.</p>
       </dl>
      <li data-md>
       <p>Let <var>clientDataJSON</var> be the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data">JSON-compatible serialization of client data</a> constructed from <var>collectedClientData</var>.</p>
@@ -2786,13 +2831,13 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
      <li data-md>
       <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑦">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item②">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑧">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑧">client platform</a> at that instant.</p>
       <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑨">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⓪">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
-or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑨">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⓪">client</a>.</p>
+or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②⓪">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②①">client</a>.</p>
      <li data-md>
-      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑧">conditional</a></code>:</p>
+      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation③">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑧">conditional</a></code>:</p>
       <ol>
        <li data-md>
         <p>If the user agent has not recently mediated an authentication, the origin of said authentication is not <var>callerOrigin</var>, or the user
-does not consent to this type of credential creation, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror③">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑦">DOMException</a></code>.</p>
+does not consent to this type of credential creation, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror③">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑧">DOMException</a></code>.</p>
         <p>It is up to the user agent to decide when it believes an authentication ceremony has
 been completed. That authentication ceremony MAY be performed via other means than the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a>.</p>
       </ol>
@@ -2809,7 +2854,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove">remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
        <dt data-md>If the user exercises a user agent user-interface option to cancel the process,
        <dd data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate③">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑧">DOMException</a></code>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate③">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code>.</p>
        <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal" id="ref-for-dom-credentialcreationoptions-signal②">signal</a></code></code> is present and <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted①">aborted</a>,
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate④">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel②">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Then throw the <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal" id="ref-for-dom-credentialcreationoptions-signal③">signal</a></code></code>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-abort-reason" id="ref-for-abortsignal-abort-reason①">abort reason</a>.</p>
@@ -2859,7 +2904,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
              <dt data-md>is capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality①">client-side credential storage modality</a>
              <dd data-md>
               <p>Let <var>requireResidentKey</var> be <code>true</code>.</p>
-             <dt data-md>is not capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality②">client-side credential storage modality</a>, or if the <a data-link-type="dfn" href="#client" id="ref-for-client②①">client</a> cannot determine authenticator capability,
+             <dt data-md>is not capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality②">client-side credential storage modality</a>, or if the <a data-link-type="dfn" href="#client" id="ref-for-client②②">client</a> cannot determine authenticator capability,
              <dd data-md>
               <p>Let <var>requireResidentKey</var> be <code>false</code>.</p>
             </dl>
@@ -2878,8 +2923,8 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
            <dd data-md>
             <ol>
              <li data-md>
-              <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑨">conditional</a></code> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑥">user verification</a> cannot be collected during the ceremony,
-throw a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror">ConstraintError</a></code> <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code>.</p>
+              <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation④">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑨">conditional</a></code> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑥">user verification</a> cannot be collected during the ceremony,
+throw a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror">ConstraintError</a></code> <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⓪">DOMException</a></code>.</p>
              <li data-md>
               <p>Let <var>userVerification</var> be <code>true</code>.</p>
             </ol>
@@ -2903,7 +2948,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <dl class="switch">
            <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise">enterprise</a></code>
            <dd data-md>
-            <p>Let <var>enterpriseAttestationPossible</var> be <code>true</code> if the user agent wishes to support enterprise attestation for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑥">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑥">id</a></code></code> (see <a href="#CreateCred-DetermineRpId">step 8</a>, above). Otherwise <code>false</code>.</p>
+            <p>Let <var>enterpriseAttestationPossible</var> be <code>true</code> if the user agent wishes to support enterprise attestation for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑦">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code></code> (see <a href="#CreateCred-DetermineRpId">step 8</a>, above). Otherwise <code>false</code>.</p>
            <dt data-md>otherwise
            <dd data-md>
             <p>Let <var>enterpriseAttestationPossible</var> be <code>false</code>.</p>
@@ -2932,7 +2977,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
            <li data-md>
             <p>Otherwise, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append②">Append</a> <var>C</var> to <var>excludeCredentialDescriptorList</var>.</p>
           </ol>
-         <li id="CreateCred-InvokeAuthnrMakeCred"><a class="self-link" href="#CreateCred-InvokeAuthnrMakeCred"></a> Invoke the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑤">authenticatorMakeCredential</a> operation on <var>authenticator</var> with <var>clientDataHash</var>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑦">rp</a></code></code>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user②">user</a></code></code>, <var>requireResidentKey</var>, <var>userVerification</var>, <var>credTypesAndPubKeyAlgs</var>, <var>excludeCredentialDescriptorList</var>, <var>enterpriseAttestationPossible</var>, <var>attestationFormats</var>,
+         <li id="CreateCred-InvokeAuthnrMakeCred"><a class="self-link" href="#CreateCred-InvokeAuthnrMakeCred"></a> Invoke the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑤">authenticatorMakeCredential</a> operation on <var>authenticator</var> with <var>clientDataHash</var>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑧">rp</a></code></code>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user②">user</a></code></code>, <var>requireResidentKey</var>, <var>userVerification</var>, <var>credTypesAndPubKeyAlgs</var>, <var>excludeCredentialDescriptorList</var>, <var>enterpriseAttestationPossible</var>, <var>attestationFormats</var>,
         and <var>authenticatorExtensions</var> as parameters. 
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append">Append</a> <var>authenticator</var> to <var>issuedRequests</var>.</p>
@@ -2958,14 +3003,14 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate⑦">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel④">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑦">remove</a> it from <var>issuedRequests</var>.</p>
          <li data-md>
-          <p>Throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⓪">DOMException</a></code>.</p>
+          <p>Throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
         </ol>
         <p class="note" role="note"><span class="marker">Note:</span> This error status is handled separately because the <var>authenticator</var> returns it only if <var>excludeCredentialDescriptorList</var> identifies a credential <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑨">bound</a> to the <var>authenticator</var> and the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑥">consented</a> to the operation. Given this explicit consent, it is acceptable for this case to be
-distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a>.</p>
+distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a>.</p>
        <dt data-md>If any <var>authenticator</var> returns an error status not equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>",
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑧">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
+        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
 details.</p>
        <dt data-md>If any <var>authenticator</var> indicates success,
        <dd data-md>
@@ -3007,17 +3052,15 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                 <ol>
                  <li data-md>
                   <p>Set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult②">attestationObjectResult</a>.fmt</code> to "none", and set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult③">attestationObjectResult</a>.attStmt</code> to be an empty <a data-link-type="dfn" href="#cbor" id="ref-for-cbor③">CBOR</a> map. (See <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> and <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>).</p>
-                 <li data-md>
-                  <p>If <var>authenticator</var> is not a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a> then replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
                 </ol>
               </ol>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect">indirect</a></code>
              <dd data-md>
-              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a> with a more privacy-friendly
+              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a> with a more privacy-friendly
 and/or more easily verifiable version of the same data (for example, by employing an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca">Anonymization CA</a>).</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-direct" id="ref-for-dom-attestationconveyancepreference-direct">direct</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise①">enterprise</a></code>
              <dd data-md>
-              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Party</a>.</p>
+              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a>.</p>
             </dl>
            <li data-md>
             <p>Let <var>attestationObject</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑤">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor①">%ArrayBuffer%</a>, containing the
@@ -3045,10 +3088,10 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                 <p><var>attestationObject</var></p>
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-transports-slot" id="ref-for-dom-authenticatorattestationresponse-transports-slot">[[transports]]</a></code>
                <dd data-md>
-                <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①①">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
-                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> behavior may be suboptimal.</p>
+                <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
+                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> behavior may be suboptimal.</p>
                 <p>If the user agent does not have any transport information, it SHOULD set this field to the empty sequence.</p>
-                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform authenticator</a>.</p>
+                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a>.</p>
               </dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot①">[[clientExtensionsResults]]</a></code>
              <dd data-md>
@@ -3064,30 +3107,75 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>. In order to prevent information leak that could identify the
-user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑧">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for details.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
     </ol>
     <p>During the above process, the user agent SHOULD show some UI to the user to guide them in the process of selecting and
-authorizing an authenticator. When <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⓪">conditional</a></code>, prominent modal UI should <i>not</i> be shown <i>unless</i> credential creation was previously consented to via means determined by the user agent.</p>
+authorizing an authenticator. When <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑤">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⓪">conditional</a></code>, prominent modal UI should <i>not</i> be shown <i>unless</i> credential creation was previously consented to via means determined by the user agent.</p>
    </div>
-   <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> script optionally specifies some criteria
-to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
-decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
-   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
+   <h5 class="heading settled" data-level="5.1.3.1" id="sctn-create-request-exceptions"><span class="secno">5.1.3.1. </span><span class="content">Create Request Exceptions</span><a class="self-link" href="#sctn-create-request-exceptions"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> can encounter a number of exceptions from a call to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">navigator.credentials.create()</a></code>.
+Some exceptions can have multiple reasons for why they happened,
+requiring the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①③">WebAuthn Relying Parties</a> to infer the actual reason based on their use of WebAuthn.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Exceptions that can be raised during processing of any <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>,
+including ones defined outside of this specification,
+are not listed here.</p>
+   <p>The following <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code> exceptions can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#aborterror" id="ref-for-aborterror">AbortError</a></code>
+    <dd data-md>
+     <p>The ceremony was cancelled by an <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>.
+See <a href="#sctn-abortoperation">§ 5.6 Abort Operations with AbortSignal</a> and <a href="#sctn-sample-aborting">§ 1.3.4 Aborting Authentication Operations</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror①">ConstraintError</a></code>
+    <dd data-md>
+     <p>Either <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②">residentKey</a></code> was set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> and no available authenticator supported resident keys,
+or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②">userVerification</a></code> was set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required②">required</a></code> and no available authenticator could perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>
+    <dd data-md>
+     <p>The authenticator used in the ceremony recognized an entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①">excludeCredentials</a></code> after the user <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑧">consented</a> to registering a credential.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>
+    <dd data-md>
+     <p>No entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code> had a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code> property of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key③">public-key</a></code>,
+or the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a> did not support any of the signature algorithms specified in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③">pubKeyCredParams</a></code>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a> was not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>,
+or <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> was not equal to or a registrable domain suffix of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a>.
+In the latter case,
+the <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a> does not support <a href="#sctn-related-origins">related origin requests</a> or the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure①">related origins validation procedure</a> failed.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>
+    <dd data-md>
+     <p>A catch-all error covering a wide range of possible reasons,
+including common ones like the user canceling out of the ceremony.
+Some of these causes are documented throughout this spec,
+while others are client-specific.</p>
+   </dl>
+   <p>The following <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-simple-exception" id="ref-for-dfn-simple-exception">simple exceptions</a> can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror①">TypeError</a></code>
+    <dd data-md>
+     <p>The <code><var>options</var></code> argument was not a valid <code><a href="#sctn-credentialcreationoptions-extension">CredentialCreationOptions</a></code> value,
+or the value of <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user③">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code></code> was empty or was longer than 64 bytes.</p>
+   </dl>
+   <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a> script optionally specifies some criteria
+to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
+decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
 should be available without <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated③">user mediation</a> (roughly, this specification’s <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①③">authorization gesture</a>), and if it does not find
-exactly one of those, it then calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]]()</a></code></code> to have
-the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a>.</p>
-   <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertions</a>, the <code>PublicKeyCredential.<dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-collectfromcredentialstore-slot"><code>[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</code></dfn></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①①">internal method</a> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot①">Credential.[[CollectFromCredentialStore]]()</a></code>, of returning an empty set.</p>
+exactly one of those, it then calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code></code> to have
+the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>.</p>
+   <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertions</a>, <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①④">PublicKeyCredential</a></code> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot①">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, of returning an empty set. <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑤">PublicKeyCredential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> is specified in the next section.</p>
    <p>In general, the user agent SHOULD show some UI to the user to guide them in selecting and authorizing an authenticator with which
-to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> script SHOULD first check that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> returns <code>true</code> in order to avoid
-the possibility of causing a user-visible error to be returned if the user agent does not support <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①②">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated④">user mediation</a>.</p>
-   <p>This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>;
+to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities②">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget①">conditionalGet</a></code> capability
+in order to prevent a user-visible error in case this feature is not available.</p>
+   <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
-   <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external-source"><span class="secno">5.1.4.1. </span><span class="content">PublicKeyCredential’s <code><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></dfn></code> Method</span><a class="self-link" href="#sctn-discover-from-external-source"></a></h5>
+   <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external-source"><span class="secno">5.1.4.1. </span><span class="content">PublicKeyCredential’s <code><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></dfn></code> Internal Method</span><a class="self-link" href="#sctn-discover-from-external-source"></a></h5>
    <div data-link-for-hint="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)">
-    <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①②">internal method</a> accepts three arguments:</p>
+    <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①①">internal method</a> accepts three arguments:</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"><code>origin</code></dfn>
      <dd data-md>
@@ -3099,12 +3187,12 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"><code>sameOriginWithAncestors</code></dfn>
      <dd data-md>
       <p>This argument is a Boolean value which is <code>true</code> if and only if the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object①">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors①">same-origin with its ancestors</a>. It is <code>false</code> if caller is cross-origin.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> Invocation of this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①③">internal method</a> indicates that it was allowed by <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a>, which is evaluated at the <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> level.
+      <p class="note" role="note"><span class="marker">Note:</span> Invocation of this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①②">internal method</a> indicates that it was allowed by <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a>, which is evaluated at the <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> level.
 See <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
     </dl>
     <p class="note" role="note"><span class="marker">Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise③">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">navigator.credentials.get()</a></code>.</p>
     <p class="note" role="note"><span class="marker">Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy①">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy①">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -3113,17 +3201,17 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>pkOptions</var> be the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey③">publicKey</a></code></code>.</p>
      <li data-md>
-      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation②">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①③">conditional</a></code>:</p>
+      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation②">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①②">conditional</a></code>:</p>
       <ol>
        <li data-md>
         <p>Let <var>credentialIdFilter</var> be the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑤">allowCredentials</a></code></code>.</p>
        <li data-md>
         <p>Set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑥">allowCredentials</a></code></code> to <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①">empty</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> This prevents <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential②">non-discoverable credentials</a> from being used during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①④">conditional</a></code> requests.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> This prevents <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential②">non-discoverable credentials</a> from being used during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①③">conditional</a></code> requests.</p>
        <li data-md>
         <p>Set a timer <var>lifetimeTimer</var> to a value of infinity.</p>
         <p class="note" role="note"><span class="marker">Note:</span> <var>lifetimeTimer</var> is set to a value of infinity so that the user has the entire lifetime of
-the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document" id="ref-for-concept-document">Document</a> to interact with any <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element">input</a></code> form control tagged with a <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens">autofill detail token</a>. For example, upon the user clicking in such an input field, the user agent can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to "try another way".</p>
+the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#clone-a-node-document" id="ref-for-clone-a-node-document">Document</a> to interact with any <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element">input</a></code> form control tagged with a <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens">autofill detail token</a>. For example, upon the user clicking in such an input field, the user agent can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to "try another way".</p>
       </ol>
      <li data-md>
       <p>Else:</p>
@@ -3132,34 +3220,49 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p>Let <var>credentialIdFilter</var> be an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty②">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a>.</p>
        <li data-md>
         <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout">timeout</a></code></code> is present, check if its value lies
-within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②②">client</a> and if not, correct it to the closest value lying within that range.
-Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code></code> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a>-specific default.</p>
+within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a> and if not, correct it to the closest value lying within that range.
+Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code></code> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a>-specific default.</p>
         <p>See the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout①">recommended range and default for a WebAuthn ceremony timeout</a> for guidance on deciding a reasonable range and default for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code></code>.</p>
         <p class="note" role="note"><span class="marker">Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
       </ol>
      <li data-md>
       <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is
-an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
+an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
      <li data-md>
-      <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a>.
-If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>, then throw a
-"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
-    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain④">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
-    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑤">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a> is allowed here. This is for simplification and also is
+      <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a>.
+If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①①">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain③">valid domain</a>, then throw a
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
+    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑤">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
+    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑥">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a> is allowed here. This is for simplification and also is
     in recognition of various issues with using direct IP address identification in concert with
     PKI-based security.</p>
      <li id="GetAssn-DetermineRpId">
-      <a class="self-link" href="#GetAssn-DetermineRpId"></a> If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid">rpId</a></code></code> is not present, then set <var>rpId</var> to <var>effectiveDomain</var>. 
-      <p>Otherwise:</p>
-      <ol>
-       <li data-md>
-        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid①">rpId</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to③">is not a registrable domain suffix of and is not
-equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
-       <li data-md>
-        <p>Set <var>rpId</var> to <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid②">rpId</a></code></code>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> <var>rpId</var> represents the caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑨">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⓪">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①①">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid③">rpId</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code>.</p>
-      </ol>
+      <a class="self-link" href="#GetAssn-DetermineRpId"></a> If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid">rpId</a></code></code> 
+      <dl class="switch">
+       <dt data-md>is present
+       <dd data-md>
+        <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid①">rpId</a></code></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to③">is not a
+registrable domain suffix of and is not equal to</a> <var>effectiveDomain</var>, and if the client</p>
+        <dl class="switch">
+         <dt data-md>supports <a href="#sctn-related-origins">related origin requests</a>
+         <dd data-md>
+          <ol>
+           <li data-md>
+            <p>Let <var>rpIdRequested</var> be the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid②">rpId</a></code></code></p>
+           <li data-md>
+            <p>Run the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure②">related origins validation procedure</a> with arguments <var>callerOrigin</var> and <var>rpIdRequested</var>.
+If the result is <code>false</code>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
+          </ol>
+         <dt data-md>does not support <a href="#sctn-related-origins">related origin requests</a>
+         <dd data-md>
+          <p>throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑥">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>.</p>
+        </dl>
+       <dt data-md>is not present
+       <dd data-md>
+        <p>Set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid③">rpId</a></code></code> to <var>effectiveDomain</var>.</p>
+      </dl>
+      <p class="note" role="note"><span class="marker">Note:</span> <var>rpId</var> represents the caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑨">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⓪">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid④">rpId</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code>.</p>
      <li data-md>
       <p>Let <var>clientExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map③">map</a> and let <var>authenticatorExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map④">map</a>.</p>
      <li data-md>
@@ -3188,13 +3291,13 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①">origin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin②">serialization of</a> <var>callerOrigin</var>.</p>
+       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin①">crossOrigin</a></code>
+       <dd data-md>
+        <p>The inverse of the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①③">internal method</a>.</p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①">topOrigin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin③">serialization of</a> <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin②">top-level origin</a> if
-the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①④">internal method</a> is <code>false</code>, else <code>undefined</code>.</p>
-       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin①">crossOrigin</a></code>
-       <dd data-md>
-        <p>The inverse of the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors①">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑤">internal method</a>.</p>
+the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors①">sameOriginWithAncestors</a></code> argument passed to this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①④">internal method</a> is <code>false</code>, else <code>undefined</code>.</p>
       </dl>
      <li data-md>
       <p>Let <var>clientDataJSON</var> be the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data①">JSON-compatible serialization of client data</a> constructed from <var>collectedClientData</var>.</p>
@@ -3208,11 +3311,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>savedCredentialIds</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
-or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a>.</p>
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
+or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a>.</p>
      <li data-md>
-      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a>.</p>
+      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">authenticator</a>.</p>
      <li data-md>
       <p>Consider the value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints">hints</a></code> and craft the user interface accordingly, as the user-agent sees fit.</p>
      <li data-md>
@@ -3226,12 +3329,12 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⓪">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑥">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①①">remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
        <dt data-md>If the user exercises a user agent user-interface option to cancel the process,
        <dd data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
        <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal②">signal</a></code></code> is present and <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted③">aborted</a>,
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①②">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑧">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①③">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Then
 throw the <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal③">signal</a></code></code>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-abort-reason" id="ref-for-abortsignal-abort-reason③">abort reason</a>.</p>
-       <dt id="GetAssn-ConditionalMediation-Interact-FormControl"><a class="self-link" href="#GetAssn-ConditionalMediation-Interact-FormControl"></a> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation③">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑤">conditional</a></code> and the user interacts with an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element①">input</a></code> or <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element" id="ref-for-the-textarea-element">textarea</a></code> form control with an <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete" id="ref-for-attr-fe-autocomplete">autocomplete</a></code> attribute whose <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type" id="ref-for-non-autofill-credential-type">non-autofill credential type</a> is <code>"webauthn"</code>, 
+       <dt id="GetAssn-ConditionalMediation-Interact-FormControl"><a class="self-link" href="#GetAssn-ConditionalMediation-Interact-FormControl"></a> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation③">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①④">conditional</a></code> and the user interacts with an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element①">input</a></code> or <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element" id="ref-for-the-textarea-element">textarea</a></code> form control with an <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete" id="ref-for-attr-fe-autocomplete">autocomplete</a></code> attribute whose <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type" id="ref-for-non-autofill-credential-type">non-autofill credential type</a> is <code>"webauthn"</code>, 
        <dd data-md>
         <div class="note" role="note">
           Note: The <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens①">autofill detail token</a> must appear immediately after the last <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens②">autofill detail token</a> of type "Normal" or "Contact". For example: 
@@ -3267,17 +3370,17 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
             </ol>
           </ol>
         </ol>
-       <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation④">mediation</a></code></code> is not <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑥">conditional</a></code>, <var>issuedRequests</var> is empty, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">allowCredentials</a></code></code> is not empty,
+       <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation④">mediation</a></code></code> is not <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑤">conditional</a></code>, <var>issuedRequests</var> is empty, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">allowCredentials</a></code></code> is not empty,
 and no <var>authenticator</var> will become available for any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑧">public key credentials</a> therein,
        <dd data-md>
-        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
+        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
        <dt data-md>If an <var>authenticator</var> becomes available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①④">client device</a>,
        <dd data-md>
         <p class="note" role="note"><span class="marker">Note:</span> This includes the case where an <var>authenticator</var> was available upon <var>lifetimeTimer</var> initiation.</p>
         <ol>
          <li data-md>
-          <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑤">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑦">conditional</a></code> and the <var>authenticator</var> supports the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery">silentCredentialDiscovery</a> operation:</p>
+          <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑤">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑥">conditional</a></code> and the <var>authenticator</var> supports the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery">silentCredentialDiscovery</a> operation:</p>
           <ol>
            <li data-md>
             <p>Let <var>collectedDiscoveredCredentialMetadata</var> be the result of invoking the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery①">silentCredentialDiscovery</a> operation on <var>authenticator</var> with <var>rpId</var> as parameter.</p>
@@ -3297,7 +3400,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
            <li data-md>
             <p>Execute the <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator①">issuing a credential request to an authenticator</a> algorithm with <var>authenticator</var>, <var>savedCredentialIds</var>, <var>pkOptions</var>, <var>rpId</var>, <var>clientDataHash</var>, and <var>authenticatorExtensions</var>.</p>
             <p>If this returns <code>false</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①④">continue</a>.</p>
-            <p class="note" role="note"><span class="marker">Note:</span> This branch is taken if <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑥">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑧">conditional</a></code> and the <var>authenticator</var> does not support the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery②">silentCredentialDiscovery</a> operation to allow use of such authenticators during a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑨">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑤">user mediation</a> request.</p>
+            <p class="note" role="note"><span class="marker">Note:</span> This branch is taken if <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑥">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑦">conditional</a></code> and the <var>authenticator</var> does not support the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery②">silentCredentialDiscovery</a> operation to allow use of such authenticators during a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑧">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated④">user mediation</a> request.</p>
            <li data-md>
             <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append②">Append</a> <var>authenticator</var> to <var>issuedRequests</var>.</p>
           </ol>
@@ -3313,7 +3416,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①④">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑨">authenticatorCancel</a> operation
 on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①⑥">remove</a> it from <var>issuedRequests</var>.</p>
-          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">Authenticators</a> may return an indication of "the user cancelled the entire operation".
+          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">Authenticators</a> may return an indication of "the user cancelled the entire operation".
 How a user agent manifests this state to users is unspecified.</p>
         </ol>
        <dt data-md>If any <var>authenticator</var> returns an error status,
@@ -3336,13 +3439,13 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
             <p>whose value is the bytes of <var>clientDataJSON</var>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-authenticatordataresult">authenticatorDataResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">authenticator</a>.</p>
+            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-signatureresult">signatureResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
+            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-userhandleresult">userHandleResult</dfn></code>
            <dd data-md>
-            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
+            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
 the returned <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⓪">user handle</a>. Otherwise, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult①">userHandleResult</a> to null.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-clientextensionresults">clientExtensionResults</dfn></code>
            <dd data-md>
@@ -3353,66 +3456,61 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
          <li data-md>
           <p>If <var>credentialIdFilter</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑥">is empty</a> and <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult②">userHandleResult</a> is null, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑥">continue</a>.</p>
          <li data-md>
-          <p>Let <var>constructAssertionAlg</var> be an algorithm that takes a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global" id="ref-for-concept-settings-object-global①">global object</a> <var>global</var>, and whose steps are:</p>
-          <ol>
-           <li data-md>
-            <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①④">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
+          <p>Let <var>settings</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. Let <var>global</var> be <var>settings</var>’ <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global" id="ref-for-concept-settings-object-global①">global object</a>.</p>
+         <li data-md>
+          <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑥">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
+          <dl>
+           <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-identifier-slot" id="ref-for-dom-publickeycredential-identifier-slot③">[[identifier]]</a></code>
+           <dd data-md>
+            <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑧">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor④">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult③">credentialIdResult</a></code>.</p>
+           <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment③">authenticatorAttachment</a></code>
+           <dd data-md>
+            <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment②">AuthenticatorAttachment</a></code> value matching the current <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality④">authenticator attachment modality</a> of <var>authenticator</var>.</p>
+           <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response③">response</a></code>
+           <dd data-md>
+            <p>A new <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse②">AuthenticatorAssertionResponse</a></code> object associated with <var>global</var> whose fields are:</p>
             <dl>
-             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-identifier-slot" id="ref-for-dom-publickeycredential-identifier-slot③">[[identifier]]</a></code>
+             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson②">clientDataJSON</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑧">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor④">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult③">credentialIdResult</a></code>.</p>
-             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment③">authenticatorAttachment</a></code>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑨">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑤">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientdatajsonresult" id="ref-for-assertioncreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
+             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata">authenticatorData</a></code>
              <dd data-md>
-              <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment②">AuthenticatorAttachment</a></code> value matching the current <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality④">authenticator attachment modality</a> of <var>authenticator</var>.</p>
-             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response③">response</a></code>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⓪">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑥">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-authenticatordataresult" id="ref-for-assertioncreationdata-authenticatordataresult">authenticatorDataResult</a></code>.</p>
+             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature">signature</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse②">AuthenticatorAssertionResponse</a></code> object associated with <var>global</var> whose fields are:</p>
-              <dl>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson②">clientDataJSON</a></code>
-               <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑨">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑤">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientdatajsonresult" id="ref-for-assertioncreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata">authenticatorData</a></code>
-               <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⓪">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑥">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-authenticatordataresult" id="ref-for-assertioncreationdata-authenticatordataresult">authenticatorDataResult</a></code>.</p>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature">signature</a></code>
-               <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①①">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑦">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-signatureresult" id="ref-for-assertioncreationdata-signatureresult">signatureResult</a></code>.</p>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle②">userHandle</a></code>
-               <dd data-md>
-                <p>If <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult③">userHandleResult</a></code> is null, set this
-field to null. Otherwise, set this field to a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①②">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑧">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult④">userHandleResult</a></code>.</p>
-              </dl>
-             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot②">[[clientExtensionsResults]]</a></code>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①①">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑦">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-signatureresult" id="ref-for-assertioncreationdata-signatureresult">signatureResult</a></code>.</p>
+             <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle②">userHandle</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①③">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑨">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientextensionresults" id="ref-for-assertioncreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
+              <p>If <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult③">userHandleResult</a></code> is null, set this
+field to null. Otherwise, set this field to a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①②">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑧">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult④">userHandleResult</a></code>.</p>
             </dl>
-           <li data-md>
-            <p>Return <var>pubKeyCred</var>.</p>
-          </ol>
+           <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot②">[[clientExtensionsResults]]</a></code>
+           <dd data-md>
+            <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①③">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑨">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientextensionresults" id="ref-for-assertioncreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
+          </dl>
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑤">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①⓪">authenticatorCancel</a> operation
 on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①⑨">remove</a> it from <var>issuedRequests</var>.</p>
          <li data-md>
-          <p>Return <var>constructAssertionAlg</var> and terminate this algorithm.</p>
+          <p>Return <var>pubKeyCred</var> and terminate this algorithm.</p>
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>. In order to prevent information leak that could identify the
-user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a> for details.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
     </ol>
    </div>
    <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2. </span><span class="content"><dfn class="dfn-paneled algorithm" data-algorithm="Issuing a credential request to an authenticator" data-dfn-for="PublicKeyCredential" data-dfn-type="dfn" data-noexport id="publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</dfn></span><a class="self-link" href="#sctn-issuing-cred-request-to-authenticator"></a></h5>
-   <p>This sub-algorithm of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]]()</a></code> encompasses the specific UI context-independent
-steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
-It is called by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]]()</a></code> from various points depending on which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑥">user mediation</a> the present <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremony</a> is subject to (e.g.: <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⓪">conditional</a></code> mediation).</p>
+   <p>This sub-algorithm of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> encompasses the specific UI context-independent
+steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
+It is called by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> from various points depending on which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑤">user mediation</a> the present <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremony</a> is subject to (e.g.: <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑨">conditional</a></code> mediation).</p>
    <p>This algorithm accepts the following arguments:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-authenticator"><code>authenticator</code></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
+     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"><code>savedCredentialIds</code></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
+     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-pkoptions"><code>pkOptions</code></dfn>
     <dd data-md>
      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions③">PublicKeyCredentialRequestOptions</a></code> object specifying the desired attributes of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑨">public key credential</a> to discover.</p>
@@ -3426,28 +3524,28 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
     <dd data-md>
      <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑧">map</a> containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier③">extension identifiers</a> to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑦">base64url encoding</a> of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑤">client extension processing</a> output for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension②">authenticator extensions</a>.</p>
    </dl>
-   <p>This algorithm returns <code>false</code> if the <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a> determines that the <var>authenticator</var> is not capable of handling the request, or <code>true</code> if
+   <p>This algorithm returns <code>false</code> if the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> determines that the <var>authenticator</var> is not capable of handling the request, or <code>true</code> if
 the request was issued successfully.</p>
    <p>The steps for <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator②">issuing a credential request to an authenticator</a> are as follows:</p>
    <ol>
     <li data-md>
-     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required②">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a>,
+     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a>,
 return <code>false</code>.</p>
     <li data-md>
      <p>Let <var>userVerification</var> be the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</dfn>, a Boolean value, as
 follows. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification①">userVerification</a></code></code></p>
      <dl class="switch">
-      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code>
+      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>
       <dd data-md>
        <p>Let <var>userVerification</var> be <code>true</code>.</p>
       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred①">preferred</a></code>
       <dd data-md>
        <p>If the <var>authenticator</var></p>
        <dl class="switch">
-        <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a>
+        <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a>
         <dd data-md>
          <p>Let <var>userVerification</var> be <code>true</code>.</p>
-        <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a>
+        <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a>
         <dd data-md>
          <p>Let <var>userVerification</var> be <code>false</code>.</p>
        </dl>
@@ -3465,7 +3563,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
          <p>Let <var>allowCredentialDescriptorList</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a>.</p>
         <li data-md>
          <p>Execute a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑧">client platform</a>-specific procedure to determine which, if any, <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⓪">public key credentials</a> described by <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①">allowCredentials</a></code></code> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⓪">bound</a> to this <var>authenticator</var>, by matching with <var>rpId</var>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑤">id</a></code></code>,
-and <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code></code>.
+and <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②">type</a></code></code>.
 Set <var>allowCredentialDescriptorList</var> to this filtered list.</p>
         <li data-md>
          <p>If <var>allowCredentialDescriptorList</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑧">is empty</a>, return <code>false</code>.</p>
@@ -3476,7 +3574,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
 value (see <a href="#authenticatorGetAssertion-return-values">here</a> in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> for more information).</p>
         <li data-md>
          <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑥">For each</a> credential descriptor <var>C</var> in <var>allowCredentialDescriptorList</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append③">append</a> each value, if any, of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑦">transports</a></code></code> to <var>distinctTransports</var>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
         <li data-md>
          <p>If <var>distinctTransports</var></p>
          <dl class="switch">
@@ -3498,24 +3596,57 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
       <dd data-md>
        <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑥">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>userVerification</var>,
 and <var>authenticatorExtensions</var> as parameters.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
+       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
     authenticator is being asked to exercise any credential it may possess that is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑨">scoped</a> to
-    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a>, as identified by <var>rpId</var>.</p>
+    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a>, as identified by <var>rpId</var>.</p>
      </dl>
     <li data-md>
      <p>Return <code>true</code>.</p>
    </ol>
-   <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span class="secno">5.1.5. </span><span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-storeCredential"></a></h4>
+   <h5 class="heading settled" data-level="5.1.4.3" id="sctn-get-request-exceptions"><span class="secno">5.1.4.3. </span><span class="content">Get Request Exceptions</span><a class="self-link" href="#sctn-get-request-exceptions"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> can encounter a number of exceptions from a call to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">navigator.credentials.get()</a></code>.
+Some exceptions can have multiple reasons for why they happened,
+requiring the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Parties</a> to infer the actual reason based on their use of WebAuthn.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Exceptions that can be raised during processing of any <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>,
+including ones defined outside of this specification,
+are not listed here.</p>
+   <p>The following <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> exceptions can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#aborterror" id="ref-for-aborterror①">AbortError</a></code>
+    <dd data-md>
+     <p>The ceremony was cancelled by an <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller③">AbortController</a></code>.
+See <a href="#sctn-abortoperation">§ 5.6 Abort Operations with AbortSignal</a> and <a href="#sctn-sample-aborting">§ 1.3.4 Aborting Authentication Operations</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑦">SecurityError</a></code>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①④">effective domain</a> was not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain④">valid domain</a>,
+or <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①⓪">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨">id</a></code></code> was not equal to or a registrable domain suffix of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑤">effective domain</a>.
+In the latter case,
+the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> does not support <a href="#sctn-related-origins">related origin requests</a> or the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure③">related origins validation procedure</a> failed.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>
+    <dd data-md>
+     <p>A catch-all error covering a wide range of possible reasons,
+including common ones like the user canceling out of the ceremony.
+Some of these causes are documented throughout this spec,
+while others are client-specific.</p>
+   </dl>
+   <p>The following <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-simple-exception" id="ref-for-dfn-simple-exception①">simple exceptions</a> can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror②">TypeError</a></code>
+    <dd data-md>
+     <p>The <code><var>options</var></code> argument was not a valid <code><a href="#sctn-credentialrequestoptions-extension">CredentialRequestOptions</a></code> value.</p>
+   </dl>
+   <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span class="secno">5.1.5. </span><span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Internal Method</span><a class="self-link" href="#sctn-storeCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)">
     <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot" id="ref-for-dom-credential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a></code> method is not supported
-for Web Authentication’s <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑤">PublicKeyCredential</a></code> type,
-so its implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-store-slot"><code>[[Store]](credential, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑥">internal method</a> always throws an error.</p>
+for Web Authentication’s <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑦">PublicKeyCredential</a></code> type,
+so its implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-store-slot"><code>[[Store]](credential, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑤">internal method</a> always throws an error.</p>
     <p class="note" role="note"><span class="marker">Note:</span> This algorithm is synchronous; the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise④">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store" id="ref-for-dom-credentialscontainer-store">navigator.credentials.store()</a></code>.</p>
-    <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal method</a> accepts two arguments:</p>
+    <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑥">internal method</a> accepts two arguments:</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-store-credential-sameoriginwithancestors-credential"><code>credential</code></dfn>
      <dd data-md>
-      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑥">PublicKeyCredential</a></code> object.</p>
+      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑧">PublicKeyCredential</a></code> object.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors"><code>sameOriginWithAncestors</code></dfn>
      <dd data-md>
       <p>This argument is a Boolean value which is <code>true</code> if and only if the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object②">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors②">same-origin with its ancestors</a>.</p>
@@ -3523,33 +3654,33 @@ <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span c
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code>.</p>
     </ol>
    </div>
    <h4 class="heading settled" data-level="5.1.6" id="sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.6. </span><span class="content">Availability of <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator②">User-Verifying Platform Authenticator</a> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span><a class="self-link" href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"></a></h4>
    <div data-link-for-hint="WebAuthentication/isUserVerifyingPlatformAuthenticatorAvailable">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①③">WebAuthn Relying Parties</a> use this method to determine whether they can create a new credential using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator③">user-verifying platform authenticator</a>.
-Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Parties</a> use this method to determine whether they can create a new credential using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator③">user-verifying platform authenticator</a>.
+Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
 If any are discovered, the promise is resolved with the value of <code>true</code>.
 Otherwise, the promise is resolved with the value of <code>false</code>.
-Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a> can take further actions to guide the user to create a credential.</p>
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> can take further actions to guide the user to create a credential.</p>
     <p>This method has no arguments and returns a Boolean value.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑦"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑨"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
 };
 </pre>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
-   <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span><a class="self-link" href="#sctn-getClientCapabilities"></a></h4>
+   <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span><a class="self-link" href="#sctn-getClientCapabilities"></a></h4>
    <div data-link-for-hint="WebAuthentication/getClientCapabilities">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to determine the availability of a limited set of <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">client</a> capabilities to offer certain workflows and experiences to users. For example, an RP may offer a sign in button on clients where only <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> transport is available or where <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②①">conditional</a></code> mediation is unavailable (instead of showing a username field).</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover availablity of these capabilities.</p>
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Parties</a> use this method to determine the availability of a limited set of <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">client</a> capabilities to offer certain workflows and experiences to users. For example, an RP may offer a sign in button on clients where only <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> transport is available or where <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⓪">conditional</a></code> mediation is unavailable (instead of showing a username field).</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover availablity of these capabilities.</p>
     <p>This method has no arguments and returns a record of capability keys to Boolean values.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑧"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②⓪"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑥"><c- b>Promise</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-publickeycredentialclientcapabilities" id="ref-for-typedefdef-publickeycredentialclientcapabilities"><c- n>PublicKeyCredentialClientCapabilities</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="getClientCapabilities()" id="dom-publickeycredential-getclientcapabilities"><code><c- g>getClientCapabilities</c-></code></dfn>();
 };
 
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①②"><c- b>DOMString</c-></a>, <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialclientcapabilities"><code><c- g>PublicKeyCredentialClientCapabilities</c-></code></dfn>;
+<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①④"><c- b>DOMString</c-></a>, <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialclientcapabilities"><code><c- g>PublicKeyCredentialClientCapabilities</c-></code></dfn>;
 </pre>
     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys">Keys</a> in <code class="idl"><a data-link-type="idl" href="#typedefdef-publickeycredentialclientcapabilities" id="ref-for-typedefdef-publickeycredentialclientcapabilities①">PublicKeyCredentialClientCapabilities</a></code> MUST be sorted in ascending lexicographical order.
 The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys①">keys</a> SHOULD contain the set of <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-enumeration-value" id="ref-for-dfn-enumeration-value">enumeration values</a> of <code class="idl"><a data-link-type="idl" href="#enumdef-clientcapability" id="ref-for-enumdef-clientcapability">ClientCapability</a></code>,
@@ -3557,50 +3688,50 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><
     <p>When the value for a given capability is <code>true</code>, the feature is known to be currently supported by the client.
 When the value for a given capability is <code>false</code>, the feature is known to be not currently supported by the client.
 When a capability does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exist</a> as a key, the availability of the client feature is not known.</p>
-    <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
-    <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseCreationOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
-identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a></code> that correspond
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
+identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑤">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions④">PublicKeyCredentialCreationOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑨"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②①"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑤"><c- n>PublicKeyCredentialCreationOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseCreationOptionsFromJSON(options)" id="dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson①"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseCreationOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialcreationoptionsjson"><code><c- g>PublicKeyCredentialCreationOptionsJSON</c-></code></dfn> {
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity"><c- n>PublicKeyCredentialRpEntity</c-></a>                    <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialRpEntity" id="dom-publickeycredentialcreationoptionsjson-rp"><code><c- g>rp</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentityjson" id="ref-for-dictdef-publickeycredentialuserentityjson"><c- n>PublicKeyCredentialUserEntityJSON</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialUserEntityJSON" id="dom-publickeycredentialcreationoptionsjson-user"><code><c- g>user</c-></code></dfn>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①②"><c- n>Base64URLString</c-></a>                                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialcreationoptionsjson-challenge"><code><c- g>challenge</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⓪"><c- n>Base64URLString</c-></a>                                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialcreationoptionsjson-challenge"><code><c- g>challenge</c-></code></dfn>;
     <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters"><c- n>PublicKeyCredentialParameters</c-></a>>        <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialParameters>" id="dom-publickeycredentialcreationoptionsjson-pubkeycredparams"><code><c- g>pubKeyCredParams</c-></code></dfn>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="unsigned long" id="dom-publickeycredentialcreationoptionsjson-timeout"><code><c- g>timeout</c-></code></dfn>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson" id="ref-for-dictdef-publickeycredentialdescriptorjson"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialDescriptorJSON>" id="dom-publickeycredentialcreationoptionsjson-excludecredentials"><code><c- g>excludeCredentials</c-></code></dfn> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria"><c- n>AuthenticatorSelectionCriteria</c-></a>                          <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorSelectionCriteria" id="dom-publickeycredentialcreationoptionsjson-authenticatorselection"><code><c- g>authenticatorSelection</c-></code></dfn>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①④"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialcreationoptionsjson-hints"><code><c- g>hints</c-></code></dfn> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑤"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-default="&quot;none&quot;" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialcreationoptionsjson-attestation"><code><c- g>attestation</c-></code></dfn> = "none";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑥"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialcreationoptionsjson-attestationformats"><code><c- g>attestationFormats</c-></code></dfn> = [];
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑥"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialcreationoptionsjson-hints"><code><c- g>hints</c-></code></dfn> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑦"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-default="&quot;none&quot;" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialcreationoptionsjson-attestation"><code><c- g>attestation</c-></code></dfn> = "none";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑧"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialcreationoptionsjson-attestationformats"><code><c- g>attestationFormats</c-></code></dfn> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson①"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientInputsJSON" id="dom-publickeycredentialcreationoptionsjson-extensions"><code><c- g>extensions</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentityjson"><code><c- g>PublicKeyCredentialUserEntityJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①③"><c- n>Base64URLString</c-></a>        <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialuserentityjson-id"><code><c- g>id</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑦"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialuserentityjson-name"><code><c- g>name</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑧"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialuserentityjson-displayname"><code><c- g>displayName</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①①"><c- n>Base64URLString</c-></a>        <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialuserentityjson-id"><code><c- g>id</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑨"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialuserentityjson-name"><code><c- g>name</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⓪"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialuserentityjson-displayname"><code><c- g>displayName</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialdescriptorjson"><code><c- g>PublicKeyCredentialDescriptorJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①④"><c- n>Base64URLString</c-></a>        <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code></dfn>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑨"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialdescriptorjson-type"><code><c- g>type</c-></code></dfn>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⓪"><c- b>DOMString</c-></a>>             <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialdescriptorjson-transports"><code><c- g>transports</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②①"><c- b>DOMString</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialdescriptorjson-type"><code><c- g>type</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①②"><c- n>Base64URLString</c-></a>        <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code></dfn>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②"><c- b>DOMString</c-></a>>             <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialdescriptorjson-transports"><code><c- g>transports</c-></code></dfn>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputsjson"><code><c- g>AuthenticationExtensionsClientInputsJSON</c-></code></dfn> {
@@ -3609,33 +3740,270 @@ <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFrom
    </div>
    <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9. </span><span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span><a class="self-link" href="#sctn-parseRequestOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseRequestOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
-identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②①">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a></code> that correspond
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
+identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②③">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type①">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑥">PublicKeyCredentialRequestOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson②">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②⓪"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②②"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑦"><c- n>PublicKeyCredentialRequestOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseRequestOptionsFromJSON(options)" id="dom-publickeycredential-parserequestoptionsfromjson"><code><c- g>parseRequestOptionsFromJSON</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson①"><c- n>PublicKeyCredentialRequestOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseRequestOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parserequestoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptionsjson"><code><c- g>PublicKeyCredentialRequestOptionsJSON</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⑤"><c- n>Base64URLString</c-></a>                                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialrequestoptionsjson-challenge"><code><c- g>challenge</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①③"><c- n>Base64URLString</c-></a>                                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-publickeycredentialrequestoptionsjson-challenge"><code><c- g>challenge</c-></code></dfn>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long①"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="unsigned long" id="dom-publickeycredentialrequestoptionsjson-timeout"><code><c- g>timeout</c-></code></dfn>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialrequestoptionsjson-rpid"><code><c- g>rpId</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②④"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialrequestoptionsjson-rpid"><code><c- g>rpId</c-></code></dfn>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑥"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson" id="ref-for-dictdef-publickeycredentialdescriptorjson①"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialDescriptorJSON>" id="dom-publickeycredentialrequestoptionsjson-allowcredentials"><code><c- g>allowCredentials</c-></code></dfn> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②③"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-default="&quot;preferred&quot;" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialrequestoptionsjson-userverification"><code><c- g>userVerification</c-></code></dfn> = "preferred";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑦"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②④"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialrequestoptionsjson-hints"><code><c- g>hints</c-></code></dfn> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑤"><c- b>DOMString</c-></a>                                               <dfn class="dfn-paneled idl-code" data-default="&quot;preferred&quot;" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-publickeycredentialrequestoptionsjson-userverification"><code><c- g>userVerification</c-></code></dfn> = "preferred";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑦"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥"><c- b>DOMString</c-></a>>                                     <dfn class="dfn-paneled idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>" id="dom-publickeycredentialrequestoptionsjson-hints"><code><c- g>hints</c-></code></dfn> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson③"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientInputsJSON" id="dom-publickeycredentialrequestoptionsjson-extensions"><code><c- g>extensions</c-></code></dfn>;
 };
 </pre>
    </div>
+   <h4 class="heading settled" data-level="5.1.10" id="sctn-signal-methods"><span class="secno">5.1.10. </span><span class="content">Signal Credential Changes to the Authenticator - PublicKeyCredential’s <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods">signal methods</a></span><a class="self-link" href="#sctn-signal-methods"></a></h4>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②③"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑦"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined" id="ref-for-idl-undefined"><c- b>undefined</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="signalUnknownCredential(options)" id="dom-publickeycredential-signalunknowncredential"><code><c- g>signalUnknownCredential</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-unknowncredentialoptions" id="ref-for-dictdef-unknowncredentialoptions"><c- n>UnknownCredentialOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/signalUnknownCredential(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-signalunknowncredential-options-options"><code><c- g>options</c-></code></dfn>);
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑧"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined" id="ref-for-idl-undefined①"><c- b>undefined</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="signalAllAcceptedCredentials(options)" id="dom-publickeycredential-signalallacceptedcredentials"><code><c- g>signalAllAcceptedCredentials</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-allacceptedcredentialsoptions" id="ref-for-dictdef-allacceptedcredentialsoptions"><c- n>AllAcceptedCredentialsOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/signalAllAcceptedCredentials(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-signalallacceptedcredentials-options-options"><code><c- g>options</c-></code></dfn>);
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑨"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined" id="ref-for-idl-undefined②"><c- b>undefined</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="signalCurrentUserDetails(options)" id="dom-publickeycredential-signalcurrentuserdetails"><code><c- g>signalCurrentUserDetails</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-currentuserdetailsoptions" id="ref-for-dictdef-currentuserdetailsoptions"><c- n>CurrentUserDetailsOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/signalCurrentUserDetails(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-signalcurrentuserdetails-options-options"><code><c- g>options</c-></code></dfn>);
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-unknowncredentialoptions"><code><c- g>UnknownCredentialOptions</c-></code></dfn> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦"><c- b>DOMString</c-></a>                     <dfn class="dfn-paneled idl-code" data-dfn-for="UnknownCredentialOptions" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-unknowncredentialoptions-rpid"><code><c- g>rpId</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①④"><c- n>Base64URLString</c-></a>               <dfn class="dfn-paneled idl-code" data-dfn-for="UnknownCredentialOptions" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-unknowncredentialoptions-credentialid"><code><c- g>credentialId</c-></code></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-allacceptedcredentialsoptions"><code><c- g>AllAcceptedCredentialsOptions</c-></code></dfn> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑧"><c- b>DOMString</c-></a>                     <dfn class="dfn-paneled idl-code" data-dfn-for="AllAcceptedCredentialsOptions" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-allacceptedcredentialsoptions-rpid"><code><c- g>rpId</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⑤"><c- n>Base64URLString</c-></a>               <dfn class="dfn-paneled idl-code" data-dfn-for="AllAcceptedCredentialsOptions" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-allacceptedcredentialsoptions-userid"><code><c- g>userId</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑧"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⑥"><c- n>Base64URLString</c-></a>>     <dfn class="dfn-paneled idl-code" data-dfn-for="AllAcceptedCredentialsOptions" data-dfn-type="dict-member" data-export data-type="sequence<Base64URLString>" id="dom-allacceptedcredentialsoptions-allacceptedcredentialids"><code><c- g>allAcceptedCredentialIds</c-></code></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-currentuserdetailsoptions"><code><c- g>CurrentUserDetailsOptions</c-></code></dfn> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨"><c- b>DOMString</c-></a>                     <dfn class="dfn-paneled idl-code" data-dfn-for="CurrentUserDetailsOptions" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-currentuserdetailsoptions-rpid"><code><c- g>rpId</c-></code></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⑦"><c- n>Base64URLString</c-></a>               <dfn class="dfn-paneled idl-code" data-dfn-for="CurrentUserDetailsOptions" data-dfn-type="dict-member" data-export data-type="Base64URLString" id="dom-currentuserdetailsoptions-userid"><code><c- g>userId</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⓪"><c- b>DOMString</c-></a>                     <dfn class="dfn-paneled idl-code" data-dfn-for="CurrentUserDetailsOptions" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-currentuserdetailsoptions-name"><code><c- g>name</c-></code></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③①"><c- b>DOMString</c-></a>                     <dfn class="dfn-paneled idl-code" data-dfn-for="CurrentUserDetailsOptions" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-currentuserdetailsoptions-displayname"><code><c- g>displayName</c-></code></dfn>;
+};
+</pre>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Parties</a> may use these <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signal-methods">signal methods</dfn> to inform <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticators</a> of the state of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credentials</a>, so that incorrect or revoked
+credentials may be updated, removed, or hidden. <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">Clients</a> provide this
+functionality opportunistically, since an authenticator may not support updating
+its <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a> or may not be attached at the time the request is
+made. Furthermore, in order to avoid revealing information about a user’s
+credentials without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">user consent</a>, <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods①">signal methods</a> do not indicate whether
+the operation succeeded. A successfully resolved promise only means that the <code>options</code> object was well formed.</p>
+   <p>Each <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods②">signal method</a> includes <dfn class="dfn-paneled" data-dfn-for="signal method" data-dfn-type="dfn" data-lt="authenticator actions" data-noexport id="signal-method-authenticator-actions">authenticator
+actions</dfn>. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">Authenticators</a> MAY choose to deviate in their <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions">authenticator actions</a> from the present specification, e.g. to ignore a
+change they have a reasonable belief would be contrary to the user’s wish, or to
+ask the user before making some change. <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions①">Authenticator actions</a> are thus provided as the recommended way to handle <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods③">signal methods</a>.</p>
+   <p>In cases where an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a> does not have the capability to process an <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions②">authenticator action</a>, <a data-link-type="dfn" href="#client" id="ref-for-client④①">clients</a> MAY choose to use existing
+infrastructure such as <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>'s <code>authenticatorCredentialManagement</code> command to achieve an equivalent effect.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods④">Signal methods</a> intentionally avoid waiting for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticators</a> to
+complete executing the <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions③">authenticator actions</a>. This measure protects users
+from <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Parties</a> gaining information about availability of their credentials
+without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> based on the timing of the request.</p>
+   <h5 class="heading settled" data-level="5.1.10.1" id="sctn-signal-methods-async-rp-id-validation"><span class="secno">5.1.10.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-asynchronous-rp-id-validation-algorithm">Asynchronous RP ID validation algorithm</dfn></span><a class="self-link" href="#sctn-signal-methods-async-rp-id-validation"></a></h5>
+   <p>The <a data-link-type="abstract-op" href="#abstract-opdef-asynchronous-rp-id-validation-algorithm" id="ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm">Asynchronous RP ID validation algorithm</a> lets <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑤">signal methods</a> validate <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP IDs</a> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a>. The algorithm takes a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a></code> <var>rpId</var> as input
+and returns a promise that rejects if the validation fails. The steps are:</p>
+   <ol>
+    <li data-md>
+     <p>Let <var>effectiveDomain</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object②">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑥">effective domain</a>. If <var>effectiveDomain</var> is
+not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain⑤">valid domain</a>, then return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with">a promise rejected with</a> "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑧">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code>.</p>
+    <li data-md>
+     <p>If <var>rpId</var> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to④">is a registrable domain suffix of or is equal to</a> <var>effectiveDomain</var>, return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-resolved-with" id="ref-for-a-promise-resolved-with">a promise resolved with</a> undefined.</p>
+    <li data-md>
+     <p>If the client does not support <a href="#sctn-related-origins">related origin
+requests</a>, return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with①">a promise rejected with</a> a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑨">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code>.</p>
+    <li data-md>
+     <p>Let <var>p</var> be <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-new-promise" id="ref-for-a-new-promise">a new promise</a>.</p>
+    <li data-md>
+     <p>Execute the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel①">in parallel</a>:</p>
+     <ol>
+      <li data-md>
+       <p>If the result of running the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure④">related origins validation procedure</a> with arguments <var>callerOrigin</var> and <var>rpId</var> is <code>true</code>, then <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#resolve" id="ref-for-resolve">resolve</a> <var>p</var>.</p>
+      <li data-md>
+       <p>Otherwise, <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#reject" id="ref-for-reject">reject</a> <var>p</var> with a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①⓪">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑨">DOMException</a></code>.</p>
+     </ol>
+    <li data-md>
+     <p>Return <var>p</var>.</p>
+   </ol>
+   <h5 class="heading settled" data-level="5.1.10.2" id="sctn-signalUnknownCredential"><span class="secno">5.1.10.2. </span><span class="content"><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential">signalUnknownCredential(options)</a></code></span><a class="self-link" href="#sctn-signalUnknownCredential"></a></h5>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential①">signalUnknownCredential</a></code> method signals that a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential id</a> was not recognized by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>,
+e.g. because it was deleted by the user. Unlike <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials">signalAllAcceptedCredentials(options)</a></code>, this
+method does not require passing the entire list of accepted <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential IDs</a> and the <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>, avoiding a privacy leak to an unauthenticated caller
+(see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>).</p>
+   <p>Upon invocation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential②">signalUnknownCredential(options)</a></code>,
+the <a data-link-type="dfn" href="#client" id="ref-for-client④②">client</a> executes these steps:</p>
+   <ol>
+    <li data-md>
+     <p>If the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-credentialid" id="ref-for-dom-unknowncredentialoptions-credentialid">credentialId</a></code></code> is an
+error, then return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with②">a promise rejected with</a> a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror③">TypeError</a></code>.</p>
+    <li data-md>
+     <p>Let <var>p</var> be the result of executing the <a data-link-type="abstract-op" href="#abstract-opdef-asynchronous-rp-id-validation-algorithm" id="ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm①">Asynchronous RP ID validation
+algorithm</a> with <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-rpid" id="ref-for-dom-unknowncredentialoptions-rpid">rpId</a></code></code>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#upon-fulfillment" id="ref-for-upon-fulfillment">Upon fulfillment</a> of <var>p</var>, run the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel②">in parallel</a>:</p>
+     <ol>
+      <li data-md>
+       <p>For every <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">client
+platform</a>, invoke the <a data-link-type="dfn" href="#signal-method-authenticator-action-unknowncredentialid" id="ref-for-signal-method-authenticator-action-unknowncredentialid">unknownCredentialId</a> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions④">authenticator action</a> with <var>options</var> as
+input.</p>
+     </ol>
+    <li data-md>
+     <p>Return <var>p</var>.</p>
+   </ol>
+   <p>The <dfn class="dfn-paneled" data-dfn-for="signal method/authenticator action" data-dfn-type="dfn" data-noexport id="signal-method-authenticator-action-unknowncredentialid">unknownCredentialId</dfn> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑤">authenticator action</a> takes an <code class="idl"><a data-link-type="idl" href="#dictdef-unknowncredentialoptions" id="ref-for-dictdef-unknowncredentialoptions①">UnknownCredentialOptions</a></code> <var>options</var> and is as follows:</p>
+   <ol>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a> <var>credential</var> in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>'s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credential map</a>:</p>
+     <ol>
+      <li data-md>
+       <p>If the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> equals <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-rpid" id="ref-for-dom-unknowncredentialoptions-rpid①">rpId</a></code></code> and the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> equals the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①①"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-credentialid" id="ref-for-dom-unknowncredentialoptions-credentialid①">credentialId</a></code></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-remove" id="ref-for-map-remove">remove</a> <var>credential</var> from the <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map③">credentials map</a> or employ an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>-specific procedure to hide it from future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremonies</a>.</p>
+     </ol>
+   </ol>
+   <div class="example" id="example-d3ff2238">
+    <a class="self-link" href="#example-d3ff2238"></a> 
+    <p>A user deletes a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a> on a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a> provided UI. Later, when trying
+to authenticate to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a> with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">allowCredentials</a></code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> UI
+offers them the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credential</a> they previously deleted. The user selects that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a>. After rejecting the sign-in attempt, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a> runs:</p>
+<pre class="language-javascript highlight">PublicKeyCredential<c- p>.</c->signalUnknownCredential<c- p>({</c->
+    rpId<c- o>:</c-> <c- u>"example.com"</c-><c- p>,</c->
+    credentialId<c- o>:</c-> <c- u>"aabbcc"</c->  <c- c1>// credential id the user just tried, base64url</c->
+<c- p>});</c->
+</pre>
+    <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> then deletes or hides the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> from future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a>.</p>
+   </div>
+   <h5 class="heading settled" data-level="5.1.10.3" id="sctn-signalAllAcceptedCredentials"><span class="secno">5.1.10.3. </span><span class="content"><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials①">signalAllAcceptedCredentials(options)</a></code></span><a class="self-link" href="#sctn-signalAllAcceptedCredentials"></a></h5>
+   <p>Signals the complete list of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ids</a> for a given user. <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Parties</a> SHOULD prefer this method over <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential③">signalUnknownCredential()</a></code> when the user is authenticated and therefore there is no privacy leak risk (see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>), since the list offers a full snapshot of
+a user’s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credentials</a> and might reflect changes that haven’t yet
+been reported to currently attached authenticators.</p>
+   <p>Upon invocation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials②">signalAllAcceptedCredentials(options)</a></code>, the <a data-link-type="dfn" href="#client" id="ref-for-client④③">client</a> executes these steps:</p>
+   <ol>
+    <li data-md>
+     <p>If the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①②"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-userid" id="ref-for-dom-allacceptedcredentialsoptions-userid">userId</a></code></code> is an
+error, then return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with③">a promise rejected with</a> a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror④">TypeError</a></code>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑦">For each</a> <var>credentialId</var> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids" id="ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids">allAcceptedCredentialIds</a></code></code>:</p>
+     <ol>
+      <li data-md>
+       <p>If the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③"> base64url decoding</a> <var>credentialId</var> is an error, then return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with④">a promise rejected with</a> a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror⑤">TypeError</a></code>.</p>
+     </ol>
+    <li data-md>
+     <p>Let <var>p</var> be the result of executing the <a data-link-type="abstract-op" href="#abstract-opdef-asynchronous-rp-id-validation-algorithm" id="ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm②">Asynchronous RP ID validation
+algorithm</a> with <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-rpid" id="ref-for-dom-allacceptedcredentialsoptions-rpid">rpId</a></code></code>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#upon-fulfillment" id="ref-for-upon-fulfillment①">Upon fulfillment</a> of <var>p</var>, run the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel③">in parallel</a>:</p>
+     <ol>
+      <li data-md>
+       <p>For every <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">client
+platform</a>, invoke the <a data-link-type="dfn" href="#signal-method-authenticator-actions-allacceptedcredentialids" id="ref-for-signal-method-authenticator-actions-allacceptedcredentialids">allAcceptedCredentialIds</a> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑥">authenticator action</a> with <var>options</var> as input.</p>
+     </ol>
+    <li data-md>
+     <p>Return <var>p</var>.</p>
+   </ol>
+   <p>The <dfn class="dfn-paneled" data-dfn-for="signal method/authenticator
+actions" data-dfn-type="dfn" data-noexport id="signal-method-authenticator-actions-allacceptedcredentialids">allAcceptedCredentialIds</dfn> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑦">authenticator
+actions</a> take an <code class="idl"><a data-link-type="idl" href="#dictdef-allacceptedcredentialsoptions" id="ref-for-dictdef-allacceptedcredentialsoptions①">AllAcceptedCredentialsOptions</a></code> <var>options</var> and are as
+follows:</p>
+   <ol>
+    <li data-md>
+     <p>Let <var>userId</var> be result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-userid" id="ref-for-dom-allacceptedcredentialsoptions-userid①">userId</a></code></code>.</p>
+    <li data-md>
+     <p>Assertion: <var>userId</var> is not an error.</p>
+    <li data-md>
+     <p>Let <var>credential</var> be <code><a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>[<var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-rpid" id="ref-for-dom-allacceptedcredentialsoptions-rpid①">rpId</a></code>, <var>userId</var>]</code>.</p>
+    <li data-md>
+     <p>If <var>credential</var> does not exist, abort these steps.</p>
+    <li data-md>
+     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids" id="ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids①">allAcceptedCredentialIds</a></code></code> does NOT <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain">contain</a> the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoding</a> the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-remove" id="ref-for-map-remove①">remove</a> <var>credential</var> from the <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑤">credentials map</a> or employ an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a>-specific procedure to hide it from future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication
+ceremonies</a>.</p>
+    <li data-md>
+     <p>Else, if <var>credential</var> has been hidden by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a>-specific
+procecure, reverse the action so that <var>credential</var> is present in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a>.</p>
+   </ol>
+   <div class="example" id="example-abe08952">
+    <a class="self-link" href="#example-abe08952"></a> 
+    <p>A user has two credentials with <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ids</a> that <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encode</a> to <code>aa</code> and <code>bb</code>. The user deletes the credential <code>aa</code> on a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> provided UI.
+The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> runs:</p>
+<pre class="language-javascript highlight">PublicKeyCredential<c- p>.</c->signalAllAcceptedCredentials<c- p>({</c->
+    rpId<c- o>:</c-> <c- u>"example.com"</c-><c- p>,</c->
+    userId<c- o>:</c-> <c- u>"aabbcc"</c-><c- p>,</c->  <c- c1>// user handle, base64url.</c->
+    allAcceptedCredentialIds<c- o>:</c-> <c- p>[</c->
+        <c- u>"bb"</c-><c- p>,</c->
+    <c- p>]</c->
+<c- p>});</c->
+</pre>
+    <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticator</a> is attached at the time of execution, it deletes or
+hides the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> corresponding to <code>aa</code> from future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication
+ceremonies</a>.</p>
+   </div>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">Authenticators</a> may not be attached at the time <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials③">signalAllAcceptedCredentials(options)</a></code> is executed.
+Therefore, <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Parties</a> may choose to run <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials④">signalAllAcceptedCredentials(options)</a></code> periodically,
+e.g. on every sign in.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Credentials not present in <code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids" id="ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids②">allAcceptedCredentialIds</a></code> will be removed or
+hidden, potentially irreversibly. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying parties</a> must exercise care that
+valid credential IDs are never omitted from the list. If a valid <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential
+ID</a> were accidentally omitted, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">relying party</a> should immediately include
+it in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑤">signalAllAcceptedCredentials(options)</a></code> as soon as
+possible to "unhide" it, if supported by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">Authenticators</a> should prefer hiding <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">public key credentials</a> for a period of time instead
+of permanently removing them whenever possible to aid recovery if a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> accidentally omits valid <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential IDs</a> from <code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids" id="ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids③">allAcceptedCredentialIds</a></code>.</p>
+   <h5 class="heading settled" data-level="5.1.10.4" id="sctn-signalCurrentUserDetails"><span class="secno">5.1.10.4. </span><span class="content"><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails">signalCurrentUserDetails(options)</a></code></span><a class="self-link" href="#sctn-signalCurrentUserDetails"></a></h5>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails①">signalCurrentUserDetails</a></code> method signals the user’s
+current <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code>.</p>
+   <p>Upon invocation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails②">signalCurrentUserDetails(options)</a></code>, the <a data-link-type="dfn" href="#client" id="ref-for-client④④">client</a> executes these steps:</p>
+   <ol>
+    <li data-md>
+     <p>If the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-userid" id="ref-for-dom-currentuserdetailsoptions-userid">userId</a></code></code> is an error,
+then return <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#a-promise-rejected-with" id="ref-for-a-promise-rejected-with⑤">a promise rejected with</a> a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror⑥">TypeError</a></code>.</p>
+    <li data-md>
+     <p>Let <var>p</var> be the result of executing the <a data-link-type="abstract-op" href="#abstract-opdef-asynchronous-rp-id-validation-algorithm" id="ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm③">Asynchronous RP ID validation
+algorithm</a> with <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-rpid" id="ref-for-dom-currentuserdetailsoptions-rpid">rpId</a></code></code>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#upon-fulfillment" id="ref-for-upon-fulfillment②">Upon fulfillment</a> of <var>p</var>, run the following steps <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel④">in parallel</a>:</p>
+     <ol>
+      <li data-md>
+       <p>For every <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client
+platform</a>, invoke the <a data-link-type="dfn" href="#signal-method-authenticator-actions-currentuserdetails" id="ref-for-signal-method-authenticator-actions-currentuserdetails">currentUserDetails</a> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑧">authenticator action</a> with <var>options</var> as input.</p>
+     </ol>
+    <li data-md>
+     <p>Return <var>p</var>.</p>
+   </ol>
+   <p>The <dfn class="dfn-paneled" data-dfn-for="signal method/authenticator actions" data-dfn-type="dfn" data-noexport id="signal-method-authenticator-actions-currentuserdetails">currentUserDetails</dfn> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑨">authenticator action</a> takes a <code class="idl"><a data-link-type="idl" href="#dictdef-currentuserdetailsoptions" id="ref-for-dictdef-currentuserdetailsoptions①">CurrentUserDetailsOptions</a></code> <var>options</var> and is as follows:</p>
+   <ol>
+    <li data-md>
+     <p>Let <var>userId</var> be result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑧"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-userid" id="ref-for-dom-currentuserdetailsoptions-userid①">userId</a></code></code>.</p>
+    <li data-md>
+     <p>Assertion: <var>userId</var> is not an error.</p>
+    <li data-md>
+     <p>Let <var>credential</var> be <code><a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑥">credentials map</a>[<var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-rpid" id="ref-for-dom-currentuserdetailsoptions-rpid①">rpId</a></code>, <var>userId</var>]</code>.</p>
+    <li data-md>
+     <p>If <var>credential</var> does not exist, abort these steps.</p>
+    <li data-md>
+     <p>Update the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui②">otherUI</a> to match <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-name" id="ref-for-dom-currentuserdetailsoptions-name">name</a></code></code> and <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-currentuserdetailsoptions-displayname" id="ref-for-dom-currentuserdetailsoptions-displayname">displayName</a></code></code>.</p>
+   </ol>
+   <div class="example" id="example-956ba6c4">
+    <a class="self-link" href="#example-956ba6c4"></a> 
+    <p>A user updates their name on a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> provided UI. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> runs:</p>
+<pre class="language-javascript highlight">PublicKeyCredential<c- p>.</c->signalCurrentUserDetails<c- p>({</c->
+    rpId<c- o>:</c-> <c- u>"example.com"</c-><c- p>,</c->
+    userId<c- o>:</c-> <c- u>"aabbcc"</c-><c- p>,</c->  <c- c1>// user handle, base64url.</c->
+    name<c- o>:</c-> <c- u>"New user name"</c-><c- p>,</c->
+    displayName<c- o>:</c-> <c- u>"New display name"</c->
+<c- p>});</c->
+</pre>
+    <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a> then updates the <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui③">otherUI</a> of the matching credential.</p>
+   </div>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">Authenticators</a> may not be attached at the time <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails③">signalCurrentUserDetails(options)</a></code> is executed.
+Therefore, <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Parties</a> may choose to run <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails④">signalCurrentUserDetails(options)</a></code> periodically, e.g. on
+every sign in.</p>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①④"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
@@ -3646,21 +4014,21 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorResponse" data-dfn-type="attribute" data-export id="dom-authenticatorresponse-clientdatajson"><code>clientDataJSON</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤">ArrayBuffer</a>, readonly</span>
      <dd data-md>
       <p>This attribute contains a <a href="#clientdatajson-serialization">JSON-compatible serialization</a> of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data">client data</a>, the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data③">hash of which</a> is passed to the
-authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
+authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestationresponse"><span class="secno">5.2.1. </span><span class="content">Information About Public Key Credential (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorattestationresponse"><code>AuthenticatorAttestationResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorattestationresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticator</a>'s response to a client’s request
-for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a>. It contains information about the new credential that can be used to
-identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a> to assess the characteristics of the credential
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a>'s response to a client’s request
+for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a>. It contains information about the new credential that can be used to
+identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> to assess the characteristics of the credential
 during registration.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext②"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed②"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse③"><c- g>AuthenticatorAttestationResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse④"><c- n>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑥"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject②"><c- g>attestationObject</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑧"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑤"><c- b>DOMString</c-></a>>                              <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getTransports()" id="dom-authenticatorattestationresponse-gettransports"><code><c- g>getTransports</c-></code></dfn>();
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③③"><c- b>DOMString</c-></a>>                              <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getTransports()" id="dom-authenticatorattestationresponse-gettransports"><code><c- g>getTransports</c-></code></dfn>();
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑦"><c- b>ArrayBuffer</c-></a>                                      <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getAuthenticatorData()" id="dom-authenticatorattestationresponse-getauthenticatordata"><code><c- g>getAuthenticatorData</c-></code></dfn>();
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑧"><c- b>ArrayBuffer</c-></a>?                                     <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKey()" id="dom-authenticatorattestationresponse-getpublickey"><code><c- g>getPublicKey</c-></code></dfn>();
-    <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier②"><c- n>COSEAlgorithmIdentifier</c-></a>                          <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKeyAlgorithm()" id="dom-authenticatorattestationresponse-getpublickeyalgorithm"><code><c- g>getPublicKeyAlgorithm</c-></code></dfn>();
+    <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier③"><c- n>COSEAlgorithmIdentifier</c-></a>                          <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKeyAlgorithm()" id="dom-authenticatorattestationresponse-getpublickeyalgorithm"><code><c- g>getPublicKeyAlgorithm</c-></code></dfn>();
 };
 </pre>
    <div>
@@ -3673,9 +4041,9 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-attestationobject"><code>attestationObject</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑨">ArrayBuffer</a>, readonly</span>
      <dd data-md>
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
-tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation
-statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
+tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation
+statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑧">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
@@ -3688,17 +4056,17 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the DER <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7">SubjectPublicKeyInfo</a> of the new credential, or null if this is not available. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm①">getPublicKeyAlgorithm()</a></code>
      <dd data-md>
-      <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier③">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
+      <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⓪">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
-   <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> value of:</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
+   <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
      <p>-7 (ES256), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters" id="ref-for-name-cose-key-common-parameters">kty</a> is 2 (with uncompressed points) and <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves" id="ref-for-name-double-coordinate-curves">crv</a> is 1 (P-256).</p>
@@ -3707,14 +4075,14 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
     <li data-md>
      <p>-8 (EdDSA), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves" id="ref-for-name-double-coordinate-curves①">crv</a> is 6 (Ed25519).</p>
    </ul>
-   <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm②">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
-   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
+   <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm②">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑥">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
+   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>'s response to a client’s request for
-generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a>'s response to a client’s request for
+generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
-optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> to a specific transaction.</p>
+optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse④"><c- g>AuthenticatorAssertionResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑥"><c- n>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
@@ -3738,23 +4106,23 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-userhandle"><code>userHandle</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑥">ArrayBuffer</a>, readonly, nullable</span>
      <dd data-md>
       <p>This attribute contains the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①①">user handle</a> returned from the authenticator, or null if the authenticator did not return a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①②">user handle</a>. See <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>. The authenticator MUST always return a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①③">user handle</a> if
-the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">allowCredentials</a></code> option used in the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremony</a> is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①②">empty</a>,
+the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">allowCredentials</a></code> option used in the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a> is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①②">empty</a>,
 and MAY return one otherwise.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><span class="secno">5.3. </span><span class="content">Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialparameters"><code>PublicKeyCredentialParameters</code></dfn>)</span><a class="self-link" href="#dictionary-credential-params"></a></h3>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters①"><c- g>PublicKeyCredentialParameters</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type②"><c- g>type</c-></a>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑥"><c- n>COSEAlgorithmIdentifier</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="COSEAlgorithmIdentifier" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg①"><c- g>alg</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑦"><c- n>COSEAlgorithmIdentifier</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="COSEAlgorithmIdentifier" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg①"><c- g>alg</c-></a>;
 };
 </pre>
    <div>
      This dictionary is used to supply additional parameters when creating a new credential. 
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑧">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑥">DOMString</a></span>
      <dd data-md>
-      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-alg"><code>alg</code></dfn>, <span> of type <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑦">COSEAlgorithmIdentifier</a></span>
+      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-alg"><code>alg</code></dfn>, <span> of type <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></span>
      <dd data-md>
       <p>This member specifies the cryptographic signature algorithm with which the newly generated credential will be used, and
 thus also the type of asymmetric key pair to be generated, e.g., RSA or Elliptic Curve.</p>
@@ -3764,18 +4132,18 @@ <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><
    </div>
    <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoptions"><span class="secno">5.4. </span><span class="content">Options for Credential Creation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialcreationoptions"><code>PublicKeyCredentialCreationOptions</code></dfn>)</span><a class="self-link" href="#dictionary-makecredentialoptions"></a></h3>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑥"><c- g>PublicKeyCredentialCreationOptions</c-></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑧"><c- g>rp</c-></a>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity"><c- n>PublicKeyCredentialUserEntity</c-></a>       <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialUserEntity" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user③"><c- g>user</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①①"><c- g>rp</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity"><c- n>PublicKeyCredentialUserEntity</c-></a>       <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialUserEntity" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④"><c- g>user</c-></a>;
 
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource②"><c- n>BufferSource</c-></a>                             <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge①"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③"><c- g>pubKeyCredParams</c-></a>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⓪"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑤"><c- g>pubKeyCredParams</c-></a>;
 
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long②"><c- b>unsigned</c-> <c- b>long</c-></a>                                <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout③"><c- g>timeout</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⓪"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①"><c- g>excludeCredentials</c-></a> = [];
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②"><c- g>excludeCredentials</c-></a> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria①"><c- n>AuthenticatorSelectionCriteria</c-></a>               <a class="idl-code" data-link-type="dict-member" data-type="AuthenticatorSelectionCriteria" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑧"><c- g>authenticatorSelection</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①①"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨"><c- b>DOMString</c-></a>>                          <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialcreationoptions-hints" id="ref-for-dom-publickeycredentialcreationoptions-hints①"><c- g>hints</c-></a> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⓪"><c- b>DOMString</c-></a>                                    <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation③"><c- g>attestation</c-></a> = "none";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①②"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③①"><c- b>DOMString</c-></a>>                          <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats①"><c- g>attestationFormats</c-></a> = [];
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①②"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦"><c- b>DOMString</c-></a>>                          <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialcreationoptions-hints" id="ref-for-dom-publickeycredentialcreationoptions-hints①"><c- g>hints</c-></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑧"><c- b>DOMString</c-></a>                                    <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation③"><c- g>attestation</c-></a> = "none";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①③"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨"><c- b>DOMString</c-></a>>                          <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats①"><c- g>attestationFormats</c-></a> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs"><c- n>AuthenticationExtensionsClientInputs</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsClientInputs" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions③"><c- g>extensions</c-></a>;
 };
 </pre>
@@ -3783,30 +4151,31 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></span>
      <dd data-md>
-      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> responsible for the request.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
+      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a> responsible for the request.</p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
-should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object②">relevant
-settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a> the credential
+should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant
+settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑦">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-user"><code>user</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity①">PublicKeyCredentialUserEntity</a></span>
      <dd data-md>
       <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a></p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremonies</a>,
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
-      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> signs, along with other data,
+      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> signs, along with other data,
 when producing an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑦">attestation object</a> for the newly created credential.
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
-      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> supports,
+      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> supports,
 ordered from most preferred to least preferred.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
-If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation fails.</p>
-      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></code> values:</p>
+Duplicates are allowed but effectively ignored.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
+If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation fails.</p>
+      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code> values:</p>
       <ul>
        <li data-md>
         <p>-8 (Ed25519)</p>
@@ -3818,115 +4187,120 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>Additional signature algorithms can be included as needed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
-      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> is willing to wait for the call to complete. This is
-treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a>.</p>
+      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> is willing to wait for the call to complete. This is
+treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
-This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
-If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticator</a>,
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥">id</a></code>).
+This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
+If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a>,
 or return an error if that fails.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
-that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
+that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a>>, defaulting to <code>[]</code></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints">PublicKeyCredentialHints</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③③">DOMString</a>, defaulting to <code>"none"</code></span>
+      <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint">PublicKeyCredentialHint</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①">DOMString</a>, defaulting to <code>"none"</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑤">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
+Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none②">none</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a>>, defaulting to <code>[]</code></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
-Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+Values are ordered from most preferred to least preferred.
+Duplicates are allowed but effectively ignored.
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
       <p>The default value is the empty list, which indicates no preference.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a>.
-For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a>.
+For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn Extensions</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity"><span class="secno">5.4.1. </span><span class="content">Public Key Entity Description (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialentity"><code>PublicKeyCredentialEntity</code></dfn>)</span><a class="self-link" href="#dictionary-pkcredentialentity"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a> is
 associated with or <a data-link-type="dfn" href="#scope" id="ref-for-scope①①">scoped</a> to, respectively.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity①"><c- g>PublicKeyCredentialEntity</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④"><c- g>name</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④③"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤"><c- g>name</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑥">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
       <ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a>, intended only
+        <p>[DEPRECATED] When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a>, intended only
 for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".</p>
+        <p>This member is deprecated because many <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">clients</a> do not display it,
+but it remains a required dictionary member for backwards compatibility. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Parties</a> MAY, as a safe default, set this equal to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
         <ul>
          <li data-md>
-          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤">name</a></code>'s value, or displaying the value to the user.</p>
+          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value, or displaying the value to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Parties</a> SHOULD consider providing this information if setting the member to a value other than the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a>.
+See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④①">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value prior to displaying the value to the user or
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤①">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
-identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client④②">Clients</a> to help users
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
+identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">Clients</a> to help users
 understand with which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> a credential is associated.</p>
         <p>Examples of suitable values for this identifier include, "alexm", "+14255551234",
 "alex.mueller@example.com", "alex.mueller@example.com (prod-env)",
 or "alex.mueller@example.com (ОАО Примертех)".</p>
         <ul>
          <li data-md>
-          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a> SHOULD perform enforcement,
+          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> SHOULD perform enforcement,
 as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS
-IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value, or displaying the value
+IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value, or displaying the value
 to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④③">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value prior to displaying the value to the user or
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤③">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑧">authenticatorMakeCredential</a> operation.</p>
         </ul>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④④">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
-      <p>Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> member’s value so that it fits within 64 bytes, if the authenticator stores the value. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When storing a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> member’s value,
+the value MAY be truncated as described in <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> using a size limit greater than or equal to 64 bytes.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> attributes when creating a new credential.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> attributes when creating a new credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨"><c- g>id</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①②"><c- g>id</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑧">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a></span>
      <dd data-md>
-      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
+      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-params"><span class="secno">5.4.3. </span><span class="content">User Account Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentity"><code>PublicKeyCredentialUserEntity</code></dfn>)</span><a class="self-link" href="#dictionary-user-credential-params"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a> attributes when creating a new
 credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity④"><c- g>PublicKeyCredentialUserEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity④"><c- n>PublicKeyCredentialEntity</c-></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥"><c- g>id</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④"><c- g>displayName</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦"><c- g>id</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤"><c- g>displayName</c-></a>;
 };
 </pre>
    <div>
@@ -3937,72 +4311,74 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
 A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence②">byte sequence</a> with a maximum size of 64 bytes,
 and is not meant to be displayed to the user.</p>
       <p>To ensure secure operation, authentication and authorization
-decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
+decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑥">user handle</a> MUST NOT contain personally identifying information about the user, such as a username or e-mail address;
 see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a> for details. The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> MUST NOT be empty.</p>
       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user accounts</a>,
 even for <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credentials</a>, because some authenticators always create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credentials</a>.
 Thus a constant <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> would prevent a user from using such an authenticator
-with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪">DOMString</a></span>
+with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑤">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a>, intended only for
-display. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice
-more than necessary. If no suitable or <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑥">human-palatable</a> name is
-available, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a> SHOULD set this value to an empty string.</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a>, intended only for
+display. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice
+more than necessary. If no suitable or <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑤">human-palatable</a> name is
+available, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> SHOULD set this value to an empty string.</p>
       <p>Examples of suitable values for this identifier include, "Alex Müller", "Alex Müller (ACME Co.)" or "田中倫".</p>
       <ul>
        <li data-md>
-        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code>'s value, or displaying the value to the user.</p>
+        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value to a non-empty string,
+or displaying a non-empty value to the user.</p>
        <li data-md>
-        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑤">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value prior to displaying the value to the user or
-including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
+        <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value prior to displaying a non-empty value to the user or
+including a non-empty value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
-      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When storing a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value,
+the value MAY be truncated as described in <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> using a size limit greater than or equal to 64 bytes.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelection"><span class="secno">5.4.4. </span><span class="content">Authenticator Selection Criteria (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorselectioncriteria"><code>AuthenticatorSelectionCriteria</code></dfn>)</span><a class="self-link" href="#dictionary-authenticatorSelection"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
 attributes.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria④"><c- g>AuthenticatorSelectionCriteria</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②"><c- g>residentKey</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③"><c- g>residentKey</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②"><c- g>userVerification</c-></a> = "preferred";
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤①"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③"><c- g>userVerification</c-></a> = "preferred";
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②">DOMString</a></span>
      <dd data-md>
-      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
+      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
 If this member is absent, then any attachment modality is acceptable.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values,
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platforms</a> MUST ignore unknown values,
 treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>.</p>
-      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code>,
+      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code>,
 which can tell what <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑤">authenticator attachment modality</a> was used
-in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤">DOMString</a></span>
+in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> operation.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
-      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③">residentKey</a></code>'s values and semantics.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code>'s values and semantics.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a>, defaulting to <code>"preferred"</code></span>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④">required</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> operation.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>.</p>
-      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③">userVerification</a></code>'s values and semantics.</p>
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> operation.
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>.</p>
+      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -4019,41 +4395,40 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
       <p>This value indicates <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment①">cross-platform attachment</a>.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options,
-sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
+   <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options, sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred②"><c- s>"preferred"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④"><c- s>"required"</c-></a>
+    <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤"><c- s>"required"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
+   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
-For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
+For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops③">Credential Properties Extension</a>.
-This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
+This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference②"><c- g>AttestationConveyancePreference</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③"><c- s>"none"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect①"><c- s>"indirect"</c-></a>,
@@ -4066,218 +4441,215 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a>.
-The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
-in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> through unmodified.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>,
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>.
+The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
+in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> in this case.
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
-      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> wants to receive an enterprise attestation, which is an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> that may include information which uniquely identifies the authenticator. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a>.</p>
+      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> with the data it needs to generate
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code> with the data it needs to generate
 an assertion. Its <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge①">challenge</a></code> member MUST be present, while its other members are OPTIONAL.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑨"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑥"><c- n>BufferSource</c-></a>                <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge②"><c- g>challenge</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long④"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout③"><c- g>timeout</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid④"><c- g>rpId</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①③"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑦"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤"><c- g>allowCredentials</c-></a> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②"><c- g>userVerification</c-></a> = "preferred";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints①"><c- g>hints</c-></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤"><c- b>DOMString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤"><c- g>rpId</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①④"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑦"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥"><c- g>allowCredentials</c-></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑥"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②"><c- g>userVerification</c-></a> = "preferred";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑦"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints①"><c- g>hints</c-></a> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs②"><c- n>AuthenticationExtensionsClientInputs</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsClientInputs" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions③"><c- g>extensions</c-></a>;
 };
 </pre>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑦">BufferSource</a></span>
     <dd data-md>
-     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> is willing to wait for the call to complete.
-The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a>.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
+     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> is willing to wait for the call to complete.
+The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a>.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧">DOMString</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> MUST verify
-that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a>.
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> MUST verify
+that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a>.</p>
      <p>If not specified, its value will
-be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
+be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object④">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑧">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑧">effective domain</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
+     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>.
 It can be used in two ways:</p>
      <ul>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
-This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
+This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
        <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
-This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> —
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> will automatically ignore non-eligible credentials
-if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>.</p>
+This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> optimize the user experience for any given situation.
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> —
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> will automatically ignore non-eligible credentials
+if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> to authenticate is not already identified,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
-In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremony</a>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a> or unspecified.
+In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a>,
 and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>,
-the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a>,
+the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
-     <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
+     <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
      <p>The list is ordered in descending order of preference: the first item in the list is the most
 preferred credential, and the last is the least preferred.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨">DOMString</a>, defaulting to <code>"preferred"</code></span>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
-     <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>'s values and semantics.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪">DOMString</a>>, defaulting to <code>[]</code></span>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑥">userVerification</a></code>'s values and semantics.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints①">PublicKeyCredentialHints</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
+     <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint①">PublicKeyCredentialHint</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span class="secno">5.6. </span><span class="content">Abort Operations with <code>AbortSignal</code></span><a class="self-link" href="#sctn-abortoperation"></a></h3>
-   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
+   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller④">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
 See <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section for detailed instructions.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section specifies that web platform APIs integrating with the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller③">AbortController</a></code> must reject the promise immediately once the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortsignal" id="ref-for-abortsignal">AbortSignal</a></code> is <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted④">aborted</a>.
-    Given the complex inheritance and parallelization structure of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑤">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> methods, the algorithms for the two APIs fulfills this
-    requirement by checking the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑤">aborted</a> property in three places. In the case of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑥">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑥">aborted</a> property is checked first in <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-create"><cite>Credential Management 1</cite> § 2.5.4 Create a Credential</a> immediately before calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a></code>,
-    then in <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> right before <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session">authenticator sessions</a> start, and finally
-    during <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session①">authenticator sessions</a>. The same goes for <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>.</p>
-   <p>The <a data-link-type="dfn" href="https://www.w3.org/TR/page-visibility/#visibility-states" id="ref-for-visibility-states">visibility</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/#focus" id="ref-for-focus">focus</a> state of the <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window" id="ref-for-window">Window</a></code> object determines whether the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑦">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
-should continue. When the <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window" id="ref-for-window①">Window</a></code> object associated with the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document" id="ref-for-concept-document①">Document</a> loses focus, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑧">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
+   <p class="note" role="note"><span class="marker">Note:</span> <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section specifies that web platform APIs integrating with the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller⑤">AbortController</a></code> must reject the promise immediately once the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortsignal" id="ref-for-abortsignal">AbortSignal</a></code> is <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted④">aborted</a>.
+    Given the complex inheritance and parallelization structure of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑤">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> methods, the algorithms for the two APIs fulfills this
+    requirement by checking the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑤">aborted</a> property in three places. In the case of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑥">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑥">aborted</a> property is checked first in <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-create"><cite>Credential Management 1</cite> § 2.5.4 Create a Credential</a> immediately before calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>,
+    then in <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Internal Method</a> right before <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session">authenticator sessions</a> start, and finally
+    during <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session①">authenticator sessions</a>. The same goes for <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>.</p>
+   <p>The <a data-link-type="dfn" href="https://www.w3.org/TR/page-visibility/#visibility-states" id="ref-for-visibility-states">visibility</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/#focus" id="ref-for-focus">focus</a> state of the <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window" id="ref-for-window">Window</a></code> object determines whether the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑦">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
+should continue. When the <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#window" id="ref-for-window①">Window</a></code> object associated with the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#clone-a-node-document" id="ref-for-clone-a-node-document①">Document</a> loses focus, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑧">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
 SHOULD be aborted.</p>
-   <p class="issue" id="issue-c0359d2a"><a class="self-link" href="#issue-c0359d2a"></a> The WHATWG HTML WG is discussing whether to provide a hook when a browsing context gains or
-    loses focuses. If a hook is provided, the above paragraph will be updated to include the hook.
-    See <a href="https://github.com/whatwg/html/issues/2711">WHATWG HTML WG Issue #2711</a> for more details.</p>
    <h3 class="heading settled" data-level="5.7" id="sctn-extensions-inputs-outputs"><span class="secno">5.7. </span><span class="content">WebAuthn Extensions Inputs and Outputs</span><a class="self-link" href="#sctn-extensions-inputs-outputs"></a></h3>
-   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn extension</a> inputs and outputs.</p>
+   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn extension</a> inputs and outputs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output">Authenticator extension outputs</a> are conveyed as a part of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">authenticator data</a> (see <a href="#table-authData">Table 1</a>).</p>
    <p class="note" role="note"><span class="marker">Note:</span> The types defined below — <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs④">AuthenticationExtensionsClientInputs</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs③">AuthenticationExtensionsClientOutputs</a></code> — are applicable to both <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①">authentication extensions</a>. The "Authentication..." portion of their names should be regarded as meaning "WebAuthentication..."</p>
    <h4 class="heading settled" data-level="5.7.1" id="iface-authentication-extensions-client-inputs"><span class="secno">5.7.1. </span><span class="content">Authentication Extensions Client Inputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑤">AuthenticationExtensionsClientInputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-inputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputs"><code><c- g>AuthenticationExtensionsClientInputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.2" id="iface-authentication-extensions-client-outputs"><span class="secno">5.7.2. </span><span class="content">Authentication Extensions Client Outputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs④">AuthenticationExtensionsClientOutputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-outputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputs"><code><c- g>AuthenticationExtensionsClientOutputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensions-authenticator-inputs"><span class="secno">5.7.3. </span><span class="content">Authentication Extensions Authenticator Inputs (CDDL type <code>AuthenticationExtensionsAuthenticatorInputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-inputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorInputs = {
-  * $$extensionInput .within ( tstr => any )
-}
+  * $$extensionInput
+} .within { * tstr => any }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
-  * $$extensionOutput .within ( tstr => any )
-}
+  * $$extensionOutput
+} .within { * tstr => any }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl①">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorOutputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑥">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
    <h3 class="heading settled" data-level="5.8" id="sctn-supporting-data-structures"><span class="secno">5.8. </span><span class="content">Supporting Data Structures</span><a class="self-link" href="#sctn-supporting-data-structures"></a></h3>
-   <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
+   <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
 follows.</p>
    <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span class="secno">5.8.1. </span><span class="content">Client Data Used in <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature">WebAuthn Signatures</a> (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-collectedclientdata"><code>CollectedClientData</code></dfn>)</span><a class="self-link" href="#dictionary-client-data"></a></h4>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a>. It is a key-value
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a>. It is a key-value
 mapping whose keys are strings. Values can be any type that has a valid encoding in JSON. Its structure is defined by the
 following Web IDL.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata②">CollectedClientData</a></code> may be extended in the future. Therefore it’s critical when parsing to be tolerant of unknown keys and of any reordering of the keys. See also <a href="#clientdatajson-verification">§ 5.8.1.2 Limited Verification Algorithm</a>.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata③"><c- g>CollectedClientData</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤①"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin②"><c- g>topOrigin</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥①"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥②"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin②"><c- g>topOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code></dfn> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑥"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
 };
 
 <c- b>enum</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-tokenbindingstatus"><code><c- g>TokenBindingStatus</c-></code></dfn> { <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present"><c- s>"present"</c-></a>, <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-supported" id="ref-for-dom-tokenbindingstatus-supported"><c- s>"supported"</c-></a> };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑦">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦">DOMString</a></span>
      <dd data-md>
       <p>This member contains the string "webauthn.create" when creating new credentials, and "webauthn.get" when getting an
 assertion from an existing credential. The purpose of this member is to prevent certain types of signature confusion
 attacks (where an attacker substitutes one legitimate signature for another).</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a></span>
+      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑨">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> of the requester, as provided to the authenticator by the client, in
 the syntax defined by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-toporigin"><code>topOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥">boolean</a></span>
+     <dd data-md>
+      <p>This OPTIONAL member contains the inverse of the <code>sameOriginWithAncestors</code> argument value
+that was passed into the <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal method</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-toporigin"><code>topOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⓪">DOMString</a></span>
      <dd data-md>
       <p>This OPTIONAL member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin③">top-level origin</a> of the requester, in the syntax defined
 by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>. It is set only if the call was made from context that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors③">same-origin with its
 ancestors</a>, i.e. if <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin③">crossOrigin</a></code> is <code>true</code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥">boolean</a></span>
-     <dd data-md>
-      <p>This OPTIONAL member contains the inverse of the <code>sameOriginWithAncestors</code> argument value
-that was passed into the <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑨">internal method</a>.</p>
      <dt data-md>[RESERVED] <dfn class="dfn-paneled" data-dfn-for="CollectedClientData" data-dfn-type="dfn" data-noexport id="dom-collectedclientdata-tokenbinding">tokenBinding</dfn>
      <dd data-md>
       <p>This OPTIONAL member contains information about the state of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1">Token Binding</a> protocol <a data-link-type="biblio" href="#biblio-tokenbinding" title="The Token Binding Protocol Version 1.0">[TokenBinding]</a> used when communicating
-with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
+with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
       <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥①">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦①">DOMString</a></span>
         <dd data-md>
-         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
+         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
          <div>
           <dl>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;supported&quot;|supported" id="dom-tokenbindingstatus-supported"><code>supported</code></dfn>
            <dd data-md>
-            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a>.</p>
+            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>.</p>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;present&quot;|present" id="dom-tokenbindingstatus-present"><code>present</code></dfn>
            <dd data-md>
-            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
+            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
           </dl>
          </div>
          <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥②">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②">DOMString</a></span>
         <dd data-md>
-         <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url
-encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a>.</p>
+         <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑨">base64url
+encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a>.</p>
        </dl>
       </div>
-      <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platform</a>-specific operation.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platform</a>-specific operation.</p>
     </dl>
     <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata④">CollectedClientData</a></code> structure is used by the client to compute the following quantities:</p>
     <dl>
@@ -4290,7 +4662,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.8.1.1" id="clientdatajson-serialization"><span class="secno">5.8.1.1. </span><span class="content">Serialization</span><a class="self-link" href="#clientdatajson-serialization"></a></h5>
-   <p>The serialization of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑥">CollectedClientData</a></code> is a subset of the algorithm for <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes" id="ref-for-serialize-a-javascript-value-to-json-bytes">JSON-serializing to bytes</a>. I.e. it produces a valid JSON encoding of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑦">CollectedClientData</a></code> but also provides additional structure that may be exploited by verifiers to avoid integrating a full JSON parser. While verifiers are recommended to perform standard JSON parsing, they may use the <a href="#clientdatajson-verification">more limited algorithm</a> below in contexts where a full JSON parser is too large. This verification algorithm requires only <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①①">base64url encoding</a>, appending of bytestrings (which could be implemented by writing into a fixed template), and simple conditional checks (assuming that inputs are known not to need escaping).</p>
+   <p>The serialization of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑥">CollectedClientData</a></code> is a subset of the algorithm for <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes" id="ref-for-serialize-a-javascript-value-to-json-bytes">JSON-serializing to bytes</a>. I.e. it produces a valid JSON encoding of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑦">CollectedClientData</a></code> but also provides additional structure that may be exploited by verifiers to avoid integrating a full JSON parser. While verifiers are recommended to perform standard JSON parsing, they may use the <a href="#clientdatajson-verification">more limited algorithm</a> below in contexts where a full JSON parser is too large. This verification algorithm requires only <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⓪">base64url encoding</a>, appending of bytestrings (which could be implemented by writing into a fixed template), and simple conditional checks (assuming that inputs are known not to need escaping).</p>
    <p>The serialization algorithm works by appending successive byte strings to an, initially empty, partial result until the complete result is obtained.</p>
    <ol>
     <li data-md>
@@ -4396,7 +4768,12 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
       <li data-md>
        <p>A string, <var>origin</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑤">origin</a></code> that issued the request to the user agent.</p>
       <li data-md>
-       <p>A boolean, <var>crossOrigin</var>, that is true if, and only if, the request should have been performed within a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element">iframe</a></code>.</p>
+       <p>An optional string, <var>topOrigin</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑥">topOrigin</a></code> that issued the request to the user agent, if available.</p>
+      <li data-md>
+       <p>A boolean, <var>requireTopOrigin</var>, that is true if, and only if, the verification should fail
+if <var>topOrigin</var> is defined and the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code> attribute is not present in <var>clientDataJSON</var>.</p>
+       <p>This means that the verification algorithm is backwards compatible
+with the <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#clientdatajson-serialization">JSON-compatible serialization algorithm</a> in Web Authentication Level 2 <a data-link-type="biblio" href="#biblio-webauthn-2-20210408" title="Web Authentication: An API for accessing Public Key Credentials - Level 2">[webauthn-2-20210408]</a> if, and only if, <var>requireTopOrigin</var> is <code>false</code>.</p>
      </ol>
     <li data-md>
      <p>Let <var>expected</var> be an empty byte string.</p>
@@ -4407,7 +4784,7 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
     <li data-md>
      <p>Append 0x2c226368616c6c656e6765223a (<code>,"challenge":</code>) to <var>expected</var>.</p>
     <li data-md>
-     <p>Perform <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①②">base64url encoding</a> on <var>challenge</var> to produce a string, <var>challengeBase64</var>.</p>
+     <p>Perform <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②①">base64url encoding</a> on <var>challenge</var> to produce a string, <var>challengeBase64</var>.</p>
     <li data-md>
      <p>Append <a data-link-type="dfn" href="#ccdtostring" id="ref-for-ccdtostring⑤">CCDToString</a>(<var>challengeBase64</var>) to <var>expected</var>.</p>
     <li data-md>
@@ -4417,13 +4794,23 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
     <li data-md>
      <p>Append 0x2c2263726f73734f726967696e223a (<code>,"crossOrigin":</code>) to <var>expected</var>.</p>
     <li data-md>
-     <p>If <var>crossOrigin</var> is true:</p>
+     <p>If <var>topOrigin</var> is defined:</p>
      <ol>
       <li data-md>
        <p>Append 0x74727565 (<code>true</code>) to <var>expected</var>.</p>
+      <li data-md>
+       <p>If <var>requireTopOrigin</var> is true
+or if 0x2c22746f704f726967696e223a (<code>,"topOrigin":</code>) is a prefix
+of the substring of <var>clientDataJSON</var> beginning at the offset equal to the length of <var>expected</var>:</p>
+       <ol>
+        <li data-md>
+         <p>Append 0x2c22746f704f726967696e223a (<code>,"topOrigin":</code>) to <var>expected</var>.</p>
+        <li data-md>
+         <p>Append <a data-link-type="dfn" href="#ccdtostring" id="ref-for-ccdtostring⑦">CCDToString</a>(<var>topOrigin</var>) to <var>expected</var>.</p>
+       </ol>
      </ol>
     <li data-md>
-     <p>Otherwise, i.e. <var>crossOrigin</var> is false:</p>
+     <p>Otherwise, i.e. <var>topOrigin</var> is not defined:</p>
      <ol>
       <li data-md>
        <p>Append 0x66616c7365 (<code>false</code>) to <var>expected</var>.</p>
@@ -4447,11 +4834,11 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
      </dl>
    </ol>
    <h5 class="heading settled" data-level="5.8.1.3" id="clientdatajson-development"><span class="secno">5.8.1.3. </span><span class="content">Future development</span><a class="self-link" href="#clientdatajson-development"></a></h5>
-   <p>In order to remain compatible with the <a href="#clientdatajson-verification">limited verification algorithm</a>, future versions of this specification must not remove any of the fields <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑥">type</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑤">challenge</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑥">origin</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑥">crossOrigin</a></code>, or <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑥">topOrigin</a></code> from <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①①">CollectedClientData</a></code>. They also must not change the <a href="#clientdatajson-verification">serialization algorithm</a> to change the order in which those fields are serialized, or insert new fields between them.</p>
+   <p>In order to remain compatible with the <a href="#clientdatajson-verification">limited verification algorithm</a>, future versions of this specification must not remove any of the fields <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑥">type</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑤">challenge</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑥">origin</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑥">crossOrigin</a></code>, or <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code> from <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①①">CollectedClientData</a></code>. They also must not change the <a href="#clientdatajson-verification">serialization algorithm</a> to change the order in which those fields are serialized, or insert new fields between them.</p>
    <p>If additional fields are added to <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①②">CollectedClientData</a></code> then verifiers that employ the <a href="#clientdatajson-verification">limited verification algorithm</a> will not be able to consider them until the two algorithms above are updated to include them. Once such an update occurs then the added fields inherit the same limitations as described in the previous paragraph. Such an algorithm update would have to accomodate serializations produced by previous versions. I.e. the verification algorithm would have to handle the fact that a sixth key–value pair may not appear sixth (or at all) if generated by a user agent working from a previous version.</p>
    <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span class="secno">5.8.2. </span><span class="content">Credential Type Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-publickeycredentialtype"><code>PublicKeyCredentialType</code></dfn>)</span><a class="self-link" href="#enum-credentialType"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑤"><c- g>PublicKeyCredentialType</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key③"><c- s>"public-key"</c-></a>
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key④"><c- s>"public-key"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑥">PublicKeyCredentialType</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
@@ -4463,35 +4850,35 @@ <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span cl
    </div>
    <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descriptor"><span class="secno">5.8.3. </span><span class="content">Credential Descriptor (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialdescriptor"><code>PublicKeyCredentialDescriptor</code></dfn>)</span><a class="self-link" href="#dictionary-credential-descriptor"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑨"><c- g>PublicKeyCredentialDescriptor</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③"><c- g>type</c-></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑧"><c- n>BufferSource</c-></a>                 <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑥"><c- g>id</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪"><c- g>transports</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑥"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪"><c- g>transports</c-></a>;
 };
 </pre>
-   <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
-It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a>.</p>
-   <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a>,
-and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>.</p>
+   <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a>.
+It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>,
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a>.</p>
+   <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential record</a>,
+and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>.</p>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑤">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑤">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.
-This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> is semantically distinct.</p>
+      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code>.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.
+This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> is semantically distinct.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
-      <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
-This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥">DOMString</a>></span>
+      <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑨">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> the caller is referring to.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
+This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥">DOMString</a>></span>
      <dd data-md>
-      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
+      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platforms</a> MUST ignore unknown values.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
 This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
-of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> operation.</p>
+of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑧">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code> operation.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="secno">5.8.4. </span><span class="content">Authenticator Transport Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatortransport"><code>AuthenticatorTransport</code></dfn>)</span><a class="self-link" href="#enum-transport"></a></h4>
@@ -4506,37 +4893,37 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport④">AuthenticatorTransport</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">clients</a>. This enumeration
+     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a> can be contacted over removable USB.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> can be contacted over removable USB.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;nfc&quot;|nfc" id="dom-authenticatortransport-nfc"><code>nfc</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;ble&quot;|ble" id="dom-authenticatortransport-ble"><code>ble</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;smart-card&quot;|smart-card" id="dom-authenticatortransport-smart-card"><code>smart-card</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-authenticatortransport-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;internal&quot;|internal" id="dom-authenticatortransport-internal"><code>internal</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
-i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a>.
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
+i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform authenticator</a>.
 These authenticators are not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑨">client device</a>.</p>
     </dl>
    </div>
-   <h4 class="heading settled" data-level="5.8.5" id="sctn-alg-identifier"><span class="secno">5.8.5. </span><span class="content">Cryptographic Algorithm Identifier (typedef <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code>)</span><a class="self-link" href="#sctn-alg-identifier"></a></h4>
+   <h4 class="heading settled" data-level="5.8.5" id="sctn-alg-identifier"><span class="secno">5.8.5. </span><span class="content">Cryptographic Algorithm Identifier (typedef <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①⓪">COSEAlgorithmIdentifier</a></code>)</span><a class="self-link" href="#sctn-alg-identifier"></a></h4>
 <pre class="idl highlight def"><c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-long" id="ref-for-idl-long"><c- b>long</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-cosealgorithmidentifier"><code><c- g>COSEAlgorithmIdentifier</c-></code></dfn>;
 </pre>
    <div>
-     A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①⓪">COSEAlgorithmIdentifier</a></code>'s value is a number identifying a cryptographic algorithm.
+     A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>'s value is a number identifying a cryptographic algorithm.
     The algorithm identifiers SHOULD be values registered in the IANA COSE Algorithms registry <a data-link-type="biblio" href="#biblio-iana-cose-algs-reg" title="IANA CBOR Object Signing and Encryption (COSE) Algorithms Registry">[IANA-COSE-ALGS-REG]</a>,
     for instance, <code>-7</code> for "ES256" and <code>-257</code> for "RS256". 
     <p>The COSE algorithms registry leaves degrees of freedom to be specified by other parameters in a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#name-key-objects" id="ref-for-name-key-objects">COSE key</a>. In order to promote interoperability, this specification makes the following additional guarantees of <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②②">credential public keys</a>:</p>
@@ -4555,50 +4942,58 @@ <h4 class="heading settled" data-level="5.8.5" id="sctn-alg-identifier"><span cl
    <p class="note" role="note"><span class="marker">Note:</span> There are many checks neccessary to correctly implement signature verification using these algorithms. One of these is that, when processing uncompressed elliptic-curve points, implementations should check that the point is actually on the curve. This check is highlighted because it’s judged to be at particular risk of falling through the gap between a cryptographic library and other code.</p>
    <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirement"><span class="secno">5.8.6. </span><span class="content">User Verification Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-userverificationrequirement"><code>UserVerificationRequirement</code></dfn>)</span><a class="self-link" href="#enum-userVerificationRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement④"><c- g>UserVerificationRequirement</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤"><c- s>"required"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑥"><c- s>"required"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred②"><c- s>"preferred"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged②"><c- s>"discouraged"</c-></a>
 };
 </pre>
-   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for some of its operations but not for others, and may use this type to express its
+   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> for some of its operations but not for others, and may use this type to express its
 needs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑤">UserVerificationRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> cannot be performed.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.8.7" id="enum-clientCapability"><span class="secno">5.8.7. </span><span class="content">Client Capability Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-clientcapability"><code>ClientCapability</code></dfn>)</span><a class="self-link" href="#enum-clientCapability"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-clientcapability" id="ref-for-enumdef-clientcapability①"><c- g>ClientCapability</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate①"><c- s>"conditionalCreate"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalmediation" id="ref-for-dom-clientcapability-conditionalmediation"><c- s>"conditionalMediation"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate②"><c- s>"conditionalCreate"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget②"><c- s>"conditionalGet"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-hybridtransport" id="ref-for-dom-clientcapability-hybridtransport"><c- s>"hybridTransport"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-passkeyplatformauthenticator" id="ref-for-dom-clientcapability-passkeyplatformauthenticator"><c- s>"passkeyPlatformAuthenticator"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-userverifyingplatformauthenticator" id="ref-for-dom-clientcapability-userverifyingplatformauthenticator"><c- s>"userVerifyingPlatformAuthenticator"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-relatedorigins" id="ref-for-dom-clientcapability-relatedorigins"><c- s>"relatedOrigins"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalallacceptedcredentials" id="ref-for-dom-clientcapability-signalallacceptedcredentials"><c- s>"signalAllAcceptedCredentials"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalcurrentuserdetails" id="ref-for-dom-clientcapability-signalcurrentuserdetails"><c- s>"signalCurrentUserDetails"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalunknowncredential" id="ref-for-dom-clientcapability-signalunknowncredential"><c- s>"signalUnknownCredential"</c-></a>
 };
 </pre>
-   <p>This enumeration defines a limited set of client capabilities which a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a> may evaluate to offer certain workflows and experiences to users.</p>
+   <p>This enumeration defines a limited set of client capabilities which a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a> may evaluate to offer certain workflows and experiences to users.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities③">getClientCapabilities()</a></code> method of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> to obtain a description of available capabilities.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-clientcapability" id="ref-for-enumdef-clientcapability②">ClientCapability</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;conditionalCreate&quot;|conditionalCreate" id="dom-clientcapability-conditionalcreate"><code>conditionalCreate</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a> is capable of a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②②">conditional</a></code> credential creation operation.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;conditionalMediation&quot;|conditionalMediation" id="dom-clientcapability-conditionalmediation"><code>conditionalMediation</code></dfn>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a> is capable of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②①">conditional</a></code> mediation for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration ceremonies</a>..</p>
+      <p>See <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Internal Method</a> for more details.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;conditionalGet&quot;|conditionalGet" id="dom-clientcapability-conditionalget"><code>conditionalGet</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Client</a> is capable of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②③">conditional</a></code> mediation.</p>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Client</a> is capable of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②②">conditional</a></code> mediation for <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremonies</a>.</p>
+      <p>This capability is equivalent to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable②">isConditionalMediationAvailable()</a></code> resolving to <code>true</code>.</p>
+      <p>See <a href="#sctn-getAssertion">§ 5.1.4 Use an Existing Credential to Make an Assertion</a> for more details.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;hybridTransport&quot;|hybridTransport" id="dom-clientcapability-hybridtransport"><code>hybridTransport</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑨">WebAuthn Client</a> supports usage of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid②">hybrid</a></code> transport.</p>
@@ -4608,31 +5003,44 @@ <h4 class="heading settled" data-level="5.8.7" id="enum-clientCapability"><span
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;userVerifyingPlatformAuthenticator&quot;|userVerifyingPlatformAuthenticator" id="dom-clientcapability-userverifyingplatformauthenticator"><code>userVerifyingPlatformAuthenticator</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①①">WebAuthn Client</a> supports usage of a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑤">user-verifying platform authenticator</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;relatedOrigins&quot;|relatedOrigins" id="dom-clientcapability-relatedorigins"><code>relatedOrigins</code></dfn>
+     <dd data-md>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①②">WebAuthn Client</a> supports <a href="#sctn-related-origins">Related Origin Requests</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;signalAllAcceptedCredentials&quot;|signalAllAcceptedCredentials" id="dom-clientcapability-signalallacceptedcredentials"><code>signalAllAcceptedCredentials</code></dfn>
+     <dd data-md>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Client</a> supports <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑥">signalAllAcceptedCredentials()</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;signalCurrentUserDetails&quot;|signalCurrentUserDetails" id="dom-clientcapability-signalcurrentuserdetails"><code>signalCurrentUserDetails</code></dfn>,
+     <dd data-md>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①④">WebAuthn Client</a> supports <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails⑤">signalCurrentUserDetails()</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ClientCapability" data-dfn-type="enum-value" data-export data-lt="&quot;signalUnknownCredential&quot;|signalUnknownCredential" id="dom-clientcapability-signalunknowncredential"><code>signalUnknownCredential</code></dfn>
+     <dd data-md>
+      <p>The <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑤">WebAuthn Client</a> supports <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential④">signalUnknownCredential()</a></code>.</p>
     </dl>
    </div>
-   <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secno">5.8.8. </span><span class="content">User-agent Hints Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-publickeycredentialhints"><code>PublicKeyCredentialHints</code></dfn>)</span><a class="self-link" href="#enum-hints"></a></h4>
-<pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints②"><c- g>PublicKeyCredentialHints</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-security-key" id="ref-for-dom-publickeycredentialhints-security-key"><c- s>"security-key"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-client-device" id="ref-for-dom-publickeycredentialhints-client-device"><c- s>"client-device"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-hybrid" id="ref-for-dom-publickeycredentialhints-hybrid"><c- s>"hybrid"</c-></a>,
+   <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secno">5.8.8. </span><span class="content">User-agent Hints Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-publickeycredentialhint"><code>PublicKeyCredentialHint</code></dfn>)</span><a class="self-link" href="#enum-hints"></a></h4>
+<pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint②"><c- g>PublicKeyCredentialHint</c-></a> {
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-security-key" id="ref-for-dom-publickeycredentialhint-security-key"><c- s>"security-key"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-client-device" id="ref-for-dom-publickeycredentialhint-client-device"><c- s>"client-device"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-hybrid" id="ref-for-dom-publickeycredentialhint-hybrid"><c- s>"hybrid"</c-></a>,
 };
 </pre>
-   <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints③">PublicKeyCredentialHints</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint③">PublicKeyCredentialHint</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
+     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones.
+    If the same hint appears more than once, its second and later appearences are ignored. 
     <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhints-security-key"><code>security-key</code></dfn>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhint-security-key"><code>security-key</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhints-client-device"><code>client-device</code></dfn>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhint-client-device"><code>client-device</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhints-hybrid"><code>hybrid</code></dfn>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhint-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -4641,27 +5049,97 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
 the feature-identifier tokens "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-create-feature" id="publickey-credentials-create-feature">publickey-credentials-create</dfn></code>"
 and "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-get-feature" id="publickey-credentials-get-feature">publickey-credentials-get</dfn></code>".
 Their <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlists</a> are both '<code>self</code>'. <a data-link-type="biblio" href="#biblio-permissions-policy" title="Permissions Policy">[Permissions-Policy]</a></p>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②⓪">internal methods</a> does not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer④">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential" id="ref-for-abstract-opdef-create-a-credential">Create a <code>Credential</code></a> and <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operations <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object①">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑨">internal methods</a> does not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑤">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer④">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential" id="ref-for-abstract-opdef-create-a-credential">Create a <code>Credential</code></a> and <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operations <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
-   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
-To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
+   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element">iframe</a></code>s.
+To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①③">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+   <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span class="secno">5.11. </span><span class="content">Using Web Authentication across related origins</span><a class="self-link" href="#sctn-related-origins"></a></h3>
+   <p>By default, Web Authentication requires that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑨">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to⑤">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②⓪">effective domain</a>.</p>
+   <p>This can make deployment challenging for large environments where multiple country-specific domains are in use (e.g. example.com vs example.co.uk vs example.sg), where alternative or brand domains are required (e.g. myexampletravel.com vs examplecruises.com), and/or where platform as a service providers are used to support mobile apps.</p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Parties</a> can opt in to allowing <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑥">WebAuthn Clients</a> to enable a credential to be created and used across a limited set of related <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origins</a>.
+Such <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> MUST choose a common <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> to use across all ceremonies from related origins.</p>
+   <p>A JSON document MUST be hosted at the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a>, and MUST be served using HTTPS. The JSON document MUST be returned as follows:</p>
+   <ul>
+    <li data-md>
+     <p>The content type MUST be <code>application/json</code>.</p>
+    <li data-md>
+     <p>The top-level JSON object MUST contain a key named <code>origins</code> whose value MUST be an array of one or more strings containing web origins.</p>
+   </ul>
+   <p>For example, for the RP ID <code>example.com</code>:</p>
+<pre class="json highlight"><c- p>{</c->
+    <c- f>"origins"</c-><c- p>:</c-> <c- p>[</c->
+        <c- u>"https://example.co.uk"</c-><c- p>,</c->
+        <c- u>"https://example.de"</c-><c- p>,</c->
+        <c- u>"https://example.sg"</c-><c- p>,</c->
+        <c- u>"https://example.net"</c-><c- p>,</c->
+        <c- u>"https://exampledelivery.com"</c-><c- p>,</c->
+        <c- u>"https://exampledelivery.co.uk"</c-><c- p>,</c->
+        <c- u>"https://exampledelivery.de"</c-><c- p>,</c->
+        <c- u>"https://exampledelivery.sg"</c-><c- p>,</c->
+        <c- u>"https://myexamplerewards.com"</c-><c- p>,</c->
+        <c- u>"https://examplecars.com"</c->
+    <c- p>]</c->
+<c- p>}</c->
+</pre>
+   <p><a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑦">WebAuthn Clients</a> supporting this feature MUST support at least five <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label①">registrable origin labels</a>. Client policy SHOULD define an upper limit to prevent abuse.</p>
+   <p>Requests to this well-known endpoint by <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑧">WebAuthn Clients</a> MUST be made without <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode">credentials</a>, without a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy">referrer</a>,
+and using the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a>. When following redirects, <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑨">WebAuthn Clients</a> MUST explicitly require all redirects to also use the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme②">scheme</a>.</p>
+   <p><a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⓪">WebAuthn Clients</a> supporting this feature SHOULD include <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-relatedorigins" id="ref-for-dom-clientcapability-relatedorigins①">relatedOrigins</a></code> in their response to <a href="#sctn-getClientCapabilities">getClientCapabilities()</a>.</p>
+   <h4 class="heading settled" data-level="5.11.1" id="sctn-validating-relation-origin"><span class="secno">5.11.1. </span><span class="content">Validating Related Origins</span><a class="self-link" href="#sctn-validating-relation-origin"></a></h4>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-related-origins-validation-procedure">related origins validation procedure</dfn>, given arguments <var>callerOrigin</var> and <var>rpIdRequested</var>, is as follows:</p>
+   <ol>
+    <li data-md>
+     <p>Let <var>maxLabels</var> be the maximum number of <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label②">registrable origin labels</a> allowed by client policy.</p>
+    <li data-md>
+     <p>Fetch the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the RP ID <var>rpIdRequested</var> (i.e., <code>https://<var>rpIdRequested</var>/.well-known/webauthn</code>) without <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode①">credentials</a>, without a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy①">referrer</a> and using the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme③">scheme</a>.</p>
+     <ol>
+      <li data-md>
+       <p>If the fetch fails, the response does not have a content type of <code>application/json</code>, or does not have a status code (after following redirects) of 200, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⓪">DOMException</a></code>.</p>
+      <li data-md>
+       <p>If the body of the resource is not a valid JSON object, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③①">DOMException</a></code>.</p>
+      <li data-md>
+       <p>If the value of the <var>origins</var> property of the JSON object is missing, or is not an array of strings, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③②">DOMException</a></code>.</p>
+     </ol>
+    <li data-md>
+     <p>Let <var>labelsSeen</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a>.</p>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">For each</a> <var>originItem</var> of <var>origins</var>:</p>
+     <ol>
+      <li data-md>
+       <p>Let <var>url</var> be the result of running the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-parser" id="ref-for-concept-url-parser">URL parser</a> with <var>originItem</var> as the input. If that fails, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
+      <li data-md>
+       <p>Let <var>domain</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②①">effective domain</a> of <var>url</var>. If that is null, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑧">continue</a>.</p>
+      <li data-md>
+       <p>Let <var>label</var> be <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label③">registrable origin label</a> of <var>domain</var>.</p>
+      <li data-md>
+       <p>If <var>label</var> is empty or null, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑨">continue</a>.</p>
+      <li data-md>
+       <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>labelsSeen</var> is greater than or equal to <var>maxLabels</var> and <var>labelsSeen</var> does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain①">contain</a> <var>label</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue②⓪">continue</a>.</p>
+      <li data-md>
+       <p>If <var>callerOrigin</var> and <var>url</var> are <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin" id="ref-for-same-origin">same origin</a>, return <code>true</code>.</p>
+      <li data-md>
+       <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size②">size</a> of <var>labelsSeen</var> is less than <var>maxLabels</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append④">append</a> <var>label</var> to <var>labelsSeen</var>.</p>
+     </ol>
+    <li data-md>
+     <p>Return <code>false</code>.</p>
+   </ol>
    <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span class="secno">6. </span><span class="content">WebAuthn <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-model">Authenticator Model</dfn></span><a class="self-link" href="#sctn-authenticator-model"></a></h2>
    <p><a href="#sctn-api">The Web Authentication API</a> implies a specific abstract functional model for a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticator</a>. This section
 describes that <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model②">authenticator model</a>.</p>
-   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
-Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platform</a>, MUST be indistinguishable
+   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
+Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">client platform</a>, MUST be indistinguishable
 from the behavior specified in <a href="#sctn-api">§ 5 Web Authentication API</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
-the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a>. For instance, this abstract model does not define protocols for
+the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -4669,17 +5147,17 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 operates at a higher security level than the rest of the authenticator. This is particularly important for authenticators that
 are embedded in the WebAuthn client, as in those cases this cryptographic module (which may, for example, be a TPM) could be
 considered more trustworthy than the rest of the authenticator.</p>
-   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a>.</p>
+   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid②">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle①">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a>.</p>
    <p>Additionally, each authenticator has an Authenticator Attestation Globally Unique Identifier or <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="aaguid">AAGUID</dfn>, which is a 128-bit identifier
 indicating the type (e.g. make and model) of the authenticator. The AAGUID MUST be chosen by its maker to be identical across all substantially identical
 authenticators made by that maker, and different (with high probability) from the AAGUIDs of all other types of authenticators. The AAGUID for a given type
-of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
-certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
-the authenticator without requesting and verifying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a>, but the AAGUID is not provably authentic without <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a>.</p>
+of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
+certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
+the authenticator without requesting and verifying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a>, but the AAGUID is not provably authentic without <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
 referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
 sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>.</p>
@@ -4692,36 +5170,36 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
      <p>The data processed by the authenticator should be small and easy to interpret in low-level code. In particular, authenticators
 should not have to parse high-level encodings such as JSON.</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
+     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
     <li data-md>
      <p>The design aims to reuse as much as possible of existing encoding formats in order to aid adoption and implementation.</p>
    </ul>
    <p>Authenticators produce cryptographic signatures for two distinct purposes:</p>
    <ol>
     <li data-md>
-     <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> provides cryptographic
-proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
-signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a> desired.
-For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
+     <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> provides cryptographic
+proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
+signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a> desired.
+For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="assertion-signature">assertion signature</dfn> is produced when the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑦">authenticatorGetAssertion</a> method is invoked. It represents an
-assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
-in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
-same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a>. It also asserts additional
-information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">user consent</a> was
-provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
+assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to a specific transaction, such as logging
+in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
+same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a>. It also asserts additional
+information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user consent</a> was
+provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
    </ol>
    <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
 The formats of these signatures, as well as the procedures for generating them, are specified below.</p>
    <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span class="secno">6.1. </span><span class="content">Authenticator Data</span><a class="self-link" href="#sctn-authenticator-data"></a></h3>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticator</a>. These bindings are
-controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a>'s assessment of the security properties of the
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a>. These bindings are
+controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
-limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a>.</p>
+limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a>.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⓪">authenticator data</a> structure is a byte array of 37 bytes or more,
 laid out as shown in <a href="#table-authData">Table <span class="table-ref-following"></span></a>.</p>
    <figure class="table" id="table-authData">
@@ -4734,7 +5212,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-rpidhash">rpIdHash</dfn>
        <td>32
-       <td> SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①④">scoped</a> to. 
+       <td> SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③④">RP ID</a> the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①④">scoped</a> to. 
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-flags">flags</dfn>
        <td>1
@@ -4778,10 +5256,10 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
          <li data-md>
           <p>Bit 5: Reserved for future use (<code>RFU2</code>).</p>
          <li data-md>
-          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">Attested credential data</a> included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-at">AT</dfn>).</p>
+          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">Attested credential data</a> included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-at">AT</dfn>).</p>
           <ul>
            <li data-md>
-            <p>Indicates whether the authenticator added <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data③">attested credential data</a>.</p>
+            <p>Indicates whether the authenticator added <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">attested credential data</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 7: Extension data included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-ed">ED</dfn>).</p>
@@ -4797,7 +5275,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata">attestedCredentialData</dfn>
        <td>variable (if present)
-       <td> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data④">attested credential data</a> (if present). See <a href="#sctn-attested-credential-data">§ 6.5.1 Attested Credential Data</a> for details. Its length depends on
+       <td> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data③">attested credential data</a> (if present). See <a href="#sctn-attested-credential-data">§ 6.5.1 Attested Credential Data</a> for details. Its length depends on
                 the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength">length</a> of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid①">credential ID</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey①">credential public
                 key</a> being attested. 
       <tr>
@@ -4809,27 +5287,34 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②③">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
         present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">authenticator data</a>. </figcaption>
    </figure>
-   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
-However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> of a
+   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
+However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a> of a
 credential does not change between operations but instead remains the same for the lifetime of that credential. Secondly, it is
-validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> that
-the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a>.</p>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a> structure</dfn>:</p>
+validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> that
+the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a>.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a> structure</dfn>:</p>
    <ul>
     <li data-md>
-     <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash">rpIdHash</a>.</p>
+     <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash">rpIdHash</a>.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①①">flag</a> SHALL be set if and only if the authenticator performed a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑥">test of user presence</a>.
-The <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①②">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a>.
+The <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①②">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>.
 The <code>RFU</code> bits SHALL be set to zero.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> If the authenticator performed both a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑦">test of user presence</a> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>,
+     <p class="note" role="note"><span class="marker">Note:</span> If the authenticator performed both a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑦">test of user presence</a> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a>,
 possibly combined in a single <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑤">authorization gesture</a>,
 then the authenticator will set both the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up①">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①③">flag</a> and the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①④">flag</a>.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signatures</a>, the authenticator MUST set the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑤">flag</a> and include the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata②">attestedCredentialData</a></code>.
-For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at①">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑥">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
+     <p>The <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑤">flag</a> SHALL be set if and only if the credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a>.
+This value MUST NOT change after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration ceremony</a> as defined in <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
+    <li data-md>
+     <p>The <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑥">flag</a> SHALL be set if and only if the credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>.</p>
+     <p>If the backup status of a credential is uncertain or the authenticator suspects a problem with the backed up credential,
+    the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑦">flag</a> SHOULD NOT be set.</p>
     <li data-md>
-     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①">extension data</a>, it MUST set the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑦">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions②">extension data</a> is included.</p>
+     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signatures</a>, the authenticator MUST set the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑧">flag</a> and include the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata②">attestedCredentialData</a></code>.
+For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at①">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑨">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
+    <li data-md>
+     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①">extension data</a>, it MUST set the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⓪">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions②">extension data</a> is included.</p>
    </ul>
    <p><a href="#fig-authData">Figure <span class="figure-num-following"></span></a> shows a visual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure.</p>
    <figure id="fig-authData">
@@ -4837,22 +5322,24 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑦">Authenticator data</a> layout.</figcaption>
    </figure>
    <div class="note" role="note">
-     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑧">flags</a> are not set, it is always 37 bytes long.
-    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑨">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⓪">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
+     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flags</a> are not set, it is always 37 bytes long.
+    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data④">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
     follows. 
-    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>).</p>
+    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>).</p>
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning,
+or a race condition might exist where the relying party is receiving and processing assertions
+in an order other than the order they were generated at the authenticator.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance or operational factors that might result in an acceptable reason for non-increasing values.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -4862,20 +5349,20 @@ <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span clas
    <h4 class="heading settled" data-level="6.1.2" id="sctn-fido-u2f-sig-format-compat"><span class="secno">6.1.2. </span><span class="content">FIDO U2F Signature Format Compatibility</span><a class="self-link" href="#sctn-fido-u2f-sig-format-compat"></a></h4>
    <p>The format for <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑥">assertion signatures</a>, which sign over the concatenation of an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a> structure and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">hash
 of the serialized client data</a>, are compatible with the FIDO U2F authentication signature format (see <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success" id="ref-for-authentication-response-message-success">Section 5.4</a> of <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>).</p>
-   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flags</a></code> except <code><a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up②">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
+   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flags</a></code> except <code><a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up②">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
 the same procedure as other <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑦">assertion signatures</a> generated by the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①③">authenticatorGetAssertion</a> operation.</p>
    <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span class="secno">6.1.3. </span><span class="content">Credential Backup State</span><a class="self-link" href="#sctn-credential-backup"></a></h4>
-   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
+   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
      <tbody>
       <tr>
-       <th><a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a>
-       <th><a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a>
+       <th><a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a>
+       <th><a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a>
        <th>Description
       <tr>
        <td><code>0</code>
@@ -4888,39 +5375,39 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
       <tr>
        <td><code>1</code>
        <td><code>0</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
       <tr>
        <td><code>1</code>
        <td><code>1</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>. 
     </table>
-    <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> combinations </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flags</a>:</p>
    <ul>
     <li data-md>
-     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticators</a>:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
+     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticators</a>:</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registered</a> and/or an account recovery process in place.
-For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registered</a> and/or an account recovery process in place.
+For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> is backed up and is protected from single device loss.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
-to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a>,
-such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
+to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>,
+such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credentials</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><span class="secno">6.2. </span><span class="content">Authenticator Taxonomy</span><a class="self-link" href="#sctn-authenticator-taxonomy"></a></h3>
-   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> used.
+   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> used.
 This section defines some terminology for those capabilities, their most important combinations,
 and which use cases those combinations enable.</p>
    <p>For example:</p>
@@ -4929,12 +5416,12 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
      <p>When authenticating for the first time on a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②③">client device</a>, a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑨">roaming authenticator</a> is typically needed
 since the user doesn’t yet have a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential①">platform credential</a> on that <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②④">client device</a>.</p>
     <li data-md>
-     <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform authenticator</a> is likely the most convenient
+     <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> is likely the most convenient
 since it’s built directly into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑥">client device</a> rather than being a separate device that the user may have to locate.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> can be used.</p>
+     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> can be used.</p>
     <li data-md>
-     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
+     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
     <li data-md>
      <p>A laptop computer might support connecting to <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⓪">roaming authenticators</a> via USB and Bluetooth,
 while a mobile phone might only support NFC.</p>
@@ -4942,11 +5429,11 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform</a> authenticator,
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform</a> authenticator,
 or in some cases both — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a>.</p>
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a>.</p>
     <li data-md>
-     <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
+     <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
     <li data-md>
      <p>Whether the authenticator is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable②">discoverable credential capable</a> — the <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality">credential storage modality</a>.</p>
    </ul>
@@ -4977,7 +5464,7 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
        <td> <a data-link-type="dfn" href="#server-side-credential-storage-modality" id="ref-for-server-side-credential-storage-modality①">Server-side storage</a> 
        <td> <a data-link-type="dfn" href="#single-factor-capable" id="ref-for-single-factor-capable①">Single-factor capable</a> 
       <tr>
-       <th> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="first-factor-roaming-authenticator">First-factor roaming authenticator</dfn> 
+       <th> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="passkey-roaming-authenticator">Passkey roaming authenticator</dfn> 
        <td> <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment③">cross-platform</a> 
        <td> <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality③">Client-side storage</a> 
        <td> <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable①">Multi-factor capable</a> 
@@ -4994,108 +5481,112 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 A <a data-link-type="dfn" href="#second-factor-roaming-authenticator" id="ref-for-second-factor-roaming-authenticator">second-factor roaming authenticator</a> is more likely to be used
 to authenticate on a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑧">client device</a> for the first time,
 or on a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a> shared between multiple users.</p>
-   <p><a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">User-verifying platform authenticators</a> and <a data-link-type="dfn" href="#first-factor-roaming-authenticator" id="ref-for-first-factor-roaming-authenticator①">first-factor roaming authenticators</a> enable passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication.
+   <p><a data-link-type="dfn" href="#passkey-platform-authenticator" id="ref-for-passkey-platform-authenticator①">Passkey platform authenticators</a> and <a data-link-type="dfn" href="#passkey-roaming-authenticator" id="ref-for-passkey-roaming-authenticator①">passkey roaming authenticators</a> enable passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication.
 In addition to the proof of possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⓪">credential private key</a>,
-these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
+these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a>.</p>
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a>.
+These authenticators also support <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a>, also called <a data-link-type="dfn" href="#passkey" id="ref-for-passkey">passkeys</a>,
+meaning they also enable authentication flows where username input is not necessary.</p>
+   <p>The <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">user-verifying platform authenticator</a> class is largely obsoleted by the <a data-link-type="dfn" href="#passkey-platform-authenticator" id="ref-for-passkey-platform-authenticator②">passkey platform authenticator</a> class,
+but the definition is still used by the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable①">isUserVerifyingPlatformAuthenticatorAvailable</a></code> method.</p>
    <p>The combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①③">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
 where the user is automatically identified by the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②①">user handle</a> and possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①①">credential private key</a> is used as the only <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⓪">authentication factor</a>.
-This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a>.</p>
+This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">multi-factor</a> authentication, but requires the user to be identified first
 which risks leaking personally identifying information; see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
    </ul>
    <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality②">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
    <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment-modality"><span class="secno">6.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-attachment-modality">Authenticator Attachment Modality</dfn></span><a class="self-link" href="#sctn-authenticator-attachment-modality"></a></h4>
-   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦③">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
-and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticators</a> that
+   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑧③">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
+and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticators</a> that
 are part of the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a> as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-authenticators">platform authenticators</dfn>, while those that are reachable via cross-platform
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client
-device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
+     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client
+device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑤">roaming authenticator</a> is attached using cross-platform transports, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cross-platform-attachment">cross-platform attachment</dfn>. Authenticators of this class are removable from, and
-can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
+can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
 credential</dfn>.</p>
    </ul>
-   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
+   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticator</a>,
-while <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
+while <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
 would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a>.</p>
-   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
+   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
 This gives the user the convenience benefit
-of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremonies</a>, e.g., the user will not have to dig around in
+of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremonies</a>, e.g., the user will not have to dig around in
 their pocket for their key fob or phone.</p>
    <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> shared between multiple users,
-or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a>;
-and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
+or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a>;
+and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
-backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> is lost.</p>
+backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
-     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
+     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> can use it.</p>
    </ol>
-   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
+   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
    <ul>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
-credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
+credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
 credential capable</dfn>.</p>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
-modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
+modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential ID</a>.</p>
    </ul>
-   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> MAY
-at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">create()</a></code>.</p>
+   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> MAY
+at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code>.</p>
    <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-capability"><span class="secno">6.2.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-factor-capability">Authentication Factor Capability</dfn></span><a class="self-link" href="#sctn-authentication-factor-capability"></a></h4>
-   <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication
+   <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication
 ceremony</a>: <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a>, <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">something you know</a> and <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you are</a>. Examples include a physical key, a password,
 and a fingerprint, respectively.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user
-verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> can
-verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> that is
-not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
+   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user
+verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> can
+verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> that is
+not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
-   <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①②">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
+   <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②①">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
 session to exist at any particular time, or by providing more complicated session management.</p>
    <p>The following operations can be invoked by the client in an authenticator session.</p>
    <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-credid"><span class="secno">6.3.1. </span><span class="content">Lookup Credential Source by Credential ID Algorithm</span><a class="self-link" href="#sctn-op-lookup-credsource-by-credid"></a></h4>
-   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
+   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
      <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
-       <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> to <var>credentialId</var>.</p>
+       <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id②">id</a> to <var>credentialId</var>.</p>
       <li data-md>
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑦">credentials map</a>:</p>
      <ol>
       <li data-md>
-       <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
+       <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id③">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
      </ol>
     <li data-md>
      <p>Return <code>null</code>.</p>
@@ -5108,26 +5599,26 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a>.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
-     <p>The constant Boolean value <code>true</code>, or <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②④">conditional</a></code> and the user agent previously collected consent from the user.</p>
+     <p>The constant Boolean value <code>true</code>, or <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑥">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②③">conditional</a></code> and the user agent previously collected consent from the user.</p>
     <dt data-md><var>requireUserVerification</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -5135,84 +5626,84 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>, if any.</p>
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> based on
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Check if at least one of the specified combinations of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑨">PublicKeyCredentialType</a></code> and cryptographic parameters in <var>credTypesAndPubKeyAlgs</var> is supported.
-If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" and terminate the operation.</p>
+If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑦">For each</a> <var>descriptor</var> of <var>excludeCredentialDescriptorList</var>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">For each</a> <var>descriptor</var> of <var>excludeCredentialDescriptorList</var>:</p>
      <ol>
       <li data-md>
        <p>If <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑦">id</a></code></code> in this authenticator
-returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③④">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code></code> respectively,
-then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user
+returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⓪">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code></code> respectively,
+then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user
 consent</a> for creating a new credential. The <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test
 of user presence</a>. If the user</p>
        <dl class="switch">
         <dt data-md>confirms consent to create a new credential
         <dd data-md>
-         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>" and terminate the operation.</p>
+         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>" and terminate the operation.</p>
         <dt data-md>does not consent to create a new credential
         <dd data-md>
-         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
+         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①④">NotAllowedError</a></code>" and terminate the operation.</p>
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑧">authorization gesture</a> is not to proceed with creating a credential,
-but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>.
+but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a>.
 If the user does not consent,
-the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
+the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
      </ol>
     <li data-md>
      <p>If <var>requireResidentKey</var> is <code>true</code> and the authenticator cannot store a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑤">client-side discoverable public key credential source</a>,
-return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror①">ConstraintError</a></code>" and terminate the operation.</p>
+return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror②">ConstraintError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>If <var>requireUserVerification</var> is <code>true</code> and the authenticator cannot perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a>, return an error code
-equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror②">ConstraintError</a></code>" and terminate the operation.</p>
+     <p>If <var>requireUserVerification</var> is <code>true</code> and the authenticator cannot perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a>, return an error code
+equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror③">ConstraintError</a></code>" and terminate the operation.</p>
     <li id="op-makecred-step-user-consent">
-     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user consent</a> for creating a new credential.
+     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">user consent</a> for creating a new credential.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⓪">authorization gesture</a> is shown by the
-    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code></code>, if possible. 
-     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a>.</p>
+    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①④">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code></code>, if possible. 
+     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑨">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a> fails, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> fails, return an error code equivalent to
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑤">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">user consent</a> has been obtained, generate a new credential object:</p>
+     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> has been obtained, generate a new credential object:</p>
      <ol>
       <li data-md>
        <p>Let (<var>publicKey</var>, <var>privateKey</var>) be a new pair of cryptographic keys using the combination of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①⓪">PublicKeyCredentialType</a></code> and cryptographic parameters represented by the first <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①⓪">item</a> in <var>credTypesAndPubKeyAlgs</var> that is supported by
 this authenticator.</p>
       <li data-md>
-       <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
+       <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code>.</p>
       <li data-md>
        <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
-         <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key④">public-key</a></code>.</p>
+         <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey">privateKey</a>
         <dd data-md>
          <p><var>privateKey</var></p>
-        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid②">rpId</a>
+        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid③">rpId</a>
         <dd data-md>
-         <p><code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①②">id</a></code></code></p>
-        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle①">userHandle</a>
+         <p><code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⑤">id</a></code></code></p>
+        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle②">userHandle</a>
         <dd data-md>
          <p><var>userHandle</var></p>
-        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui②">otherUI</a>
+        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui④">otherUI</a>
         <dd data-md>
          <p>Any other information the authenticator chooses to include.</p>
        </dl>
@@ -5220,13 +5711,13 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        <p>If <var>requireResidentKey</var> is <code>true</code> or the authenticator chooses to create a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑥">client-side discoverable public key credential source</a>:</p>
        <ol>
         <li data-md>
-         <p>Let <var>credentialId</var> be a new <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑧">credential id</a>.</p>
+         <p>Let <var>credentialId</var> be a new <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential id</a>.</p>
         <li data-md>
-         <p>Set <var>credentialSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id②">id</a> to <var>credentialId</var>.</p>
+         <p>Set <var>credentialSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id④">id</a> to <var>credentialId</var>.</p>
         <li data-md>
-         <p>Let <var>credentials</var> be this authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credentials map</a>.</p>
+         <p>Let <var>credentials</var> be this authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑧">credentials map</a>.</p>
         <li data-md>
-         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
+         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⑥">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
        </ol>
       <li data-md>
        <p>Otherwise:</p>
@@ -5240,10 +5731,10 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>If any error occurred while creating the new credential object, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror①">UnknownError</a></code>" and
 terminate the operation.</p>
     <li data-md>
-     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension
+     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate④">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input②">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a>:</p>
+     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>:</p>
      <dl class="switch">
       <dt data-md>is a U2F device
       <dd data-md>
@@ -5259,7 +5750,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        <p>let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑨">signature counter</a> value for the new credential be constant at zero.</p>
      </dl>
     <li data-md>
-     <p>Let <var>attestedCredentialData</var> be the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑧">attested credential data</a> byte array including the <var>credentialId</var> and <var>publicKey</var>.</p>
+     <p>Let <var>attestedCredentialData</var> be the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a> byte array including the <var>credentialId</var> and <var>publicKey</var>.</p>
     <li data-md>
      <p>Let <var>attestationFormat</var> be the first supported <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier">attestation statement format identifier</a> from <var>attestationFormats</var>, taking into account <var>enterpriseAttestationPossible</var>.
 If <var>attestationFormats</var> contains no supported value, then let <var>attestationFormat</var> be the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier①">attestation statement format identifier</a> most preferred by this authenticator.</p>
@@ -5274,13 +5765,13 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the user agent and the client.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the user agent and the client.</p>
     <dt data-md><var>hash</var>
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -5293,48 +5784,48 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
-   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential sources</a>.</p>
     <li data-md>
-     <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
+     <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
       <li data-md>
        <p>Let <var>credSource</var> be the result of <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up①">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⓪">id</a></code></code> in this
 authenticator.</p>
       <li data-md>
-       <p>If <var>credSource</var> is not <code>null</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append④">append</a> it to <var>credentialOptions</var>.</p>
+       <p>If <var>credSource</var> is not <code>null</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑤">append</a> it to <var>credentialOptions</var>.</p>
      </ol>
     <li data-md>
-     <p>Otherwise (<var>allowCredentialDescriptorList</var> was not supplied), <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate④">for each</a> <var>key</var> → <var>credSource</var> of this
-authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map③">credentials map</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑤">append</a> <var>credSource</var> to <var>credentialOptions</var>.</p>
+     <p>Otherwise (<var>allowCredentialDescriptorList</var> was not supplied), <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> <var>key</var> → <var>credSource</var> of this
+authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑨">credentials map</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑥">append</a> <var>credSource</var> to <var>credentialOptions</var>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②⓪">Remove</a> any items from <var>credentialOptions</var> whose <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid③">rpId</a> is not equal to <var>rpId</var>.</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②⓪">Remove</a> any items from <var>credentialOptions</var> whose <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid④">rpId</a> is not equal to <var>rpId</var>.</p>
     <li data-md>
-     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①④">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑥">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
      <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
-    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
+    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> may be shown
-    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
-     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a>.</p>
+    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
+     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①①">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a>, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑤">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">consent</a>, return an error code equivalent to
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑦">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension
+     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input④">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
      <p>Increment the credential associated <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⓪">signature counter</a> or the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②①">signature counter</a> value, depending on
-which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a>, by some positive value.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
+which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticator</a>, by some positive value.
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
 zero.</p>
     <li data-md>
      <p>Let <var>authenticatorData</var> <a data-link-type="dfn" href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure" id="ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure①">be the byte array</a> specified in <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a> including <var>processedExtensions</var>, if any, as
@@ -5355,21 +5846,21 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <a class="self-link" href="#authenticatorGetAssertion-return-values"></a> Return to the user agent: 
      <ul>
       <li data-md>
-       <p><var>selectedCredential</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id③">id</a>, if either a list of credentials
+       <p><var>selectedCredential</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">id</a>, if either a list of credentials
 (i.e., <var>allowCredentialDescriptorList</var>) of length 2 or greater was
 supplied by the client, or no such list was supplied.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> If, within <var>allowCredentialDescriptorList</var>, the client supplied exactly one credential and it was successfully employed, then its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑨">credential ID</a> is not returned since the client already knows it. This saves transmitting these bytes over
+       <p class="note" role="note"><span class="marker">Note:</span> If, within <var>allowCredentialDescriptorList</var>, the client supplied exactly one credential and it was successfully employed, then its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> is not returned since the client already knows it. This saves transmitting these bytes over
         what may be a constrained connection in what is likely a common case.</p>
       <li data-md>
        <p><var>authenticatorData</var></p>
       <li data-md>
        <p><var>signature</var></p>
       <li data-md>
-       <p><var>selectedCredential</var>.<a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle②">userHandle</a></p>
-       <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
+       <p><var>selectedCredential</var>.<a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a></p>
+       <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle④">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5378,14 +5869,14 @@ <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="
 client ignores any further responses from the authenticator for the canceled operation.</p>
    <p>This operation is ignored if it is invoked in an <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session⑤">authenticator session</a> which does not have an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑤">authenticatorMakeCredential</a> or <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑤">authenticatorGetAssertion</a> operation currently in progress.</p>
    <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><span class="secno">6.3.5. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="silentcredentialdiscovery">silentCredentialDiscovery</dfn> operation</span><a class="self-link" href="#sctn-op-silent-discovery"></a></h4>
-   <p>This is an OPTIONAL operation authenticators MAY support to enable <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑦">user mediation</a>.</p>
+   <p>This is an OPTIONAL operation authenticators MAY support to enable <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②④">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑥">user mediation</a>.</p>
    <p>It takes the following input parameter:</p>
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a>.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④②">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a>.</p>
    </dl>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Let <var>collectedDiscoverableCredentialMetadata</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑥">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①①">items</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata">DiscoverableCredentialMetadata</dfn> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct④">structs</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①⓪">items</a>:</p>
@@ -5395,7 +5886,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>A <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①①">PublicKeyCredentialType</a></code>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-id">id</dfn>
       <dd data-md>
-       <p>A <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">Credential ID</a>.</p>
+       <p>A <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑥">Credential ID</a>.</p>
       <dt data-md>rpId
       <dd data-md>
        <p>A <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier④">Relying Party Identifier</a>.</p>
@@ -5404,17 +5895,17 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user handle</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-otherui">otherUI</dfn>
       <dd data-md>
-       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> to inform its UI.</p>
+       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①⓪">credentials map</a>:</p>
      <ol>
       <li data-md>
-       <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
+       <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue②①">continue</a>.</p>
       <li data-md>
-       <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid④">rpId</a> is not <var>rpId</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑧">continue</a>.</p>
+       <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑤">rpId</a> is not <var>rpId</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue②②">continue</a>.</p>
       <li data-md>
-       <p>Let <var>discoveredCredentialMetadata</var> be a new <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata②">DiscoverableCredentialMetadata</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑤">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①①">items</a> are copies of <var>credSource</var>’s <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type③">type</a>, <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id④">id</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑤">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle④">userHandle</a> and <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui③">otherUI</a>.</p>
+       <p>Let <var>discoveredCredentialMetadata</var> be a new <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata②">DiscoverableCredentialMetadata</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑤">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①①">items</a> are copies of <var>credSource</var>’s <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type③">type</a>, <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑥">id</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑤">userHandle</a> and <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui⑤">otherUI</a>.</p>
       <li data-md>
        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append③">Append</a> <var>discoveredCredentialMetadata</var> to <var>collectedDiscoverableCredentialMetadata</var>.</p>
      </ol>
@@ -5422,87 +5913,116 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
      <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⑤">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
-   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
-   <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
+   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a>.
+When the chosen accommodation is string truncation, care needs to be taken to not corrupt the string value.</p>
+   <p>For example, truncation based on Unicode code points alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> to be truncated.
+This could make the grapheme cluster render as a different glyph,
+potentially changing the meaning of the string, instead of removing the glyph entirely.
+For example, <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> shows the end of a UTF-8 encoded string whose encoding is 65 bytes long.
+If truncating to 64 bytes then the final 0x88 byte is removed first to satisfy the size limit.
+Since that leaves a partial UTF-8 code point, the remainder of that code point must also be removed.
+Since that leaves a partial <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster①">grapheme cluster</a>, the remainder of that cluster should also be removed.</p>
    <figure id="fig-stringTruncation">
      <img src="images/string-truncation.svg"> 
     <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
    </figure>
-   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
-   <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
-   <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticators</a>, user agents SHOULD:</p>
+   <p>The responsibility for handling these concerns falls primarily on the <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a>,
+to avoid burdening <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticators</a> with understanding character encodings and Unicode character properties.
+The following subsections define requirements for how clients and authenticators,
+respectively, may perform string truncation.</p>
+   <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-client"><span class="secno">6.4.1.1. </span><span class="content">String Truncation by Clients</span><a class="self-link" href="#sctn-strings-truncation-client"></a></h5>
+   <p>When a <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②②">WebAuthn Client</a> truncates a string,
+the truncation behaviour observable by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> MUST satisfy the following requirements:</p>
+   <p>Choose a size limit equal to or greater than the specified minimum supported length.
+The string MAY be truncated so that its length in bytes in the UTF-8 character encoding satisfies that limit.
+This truncation MUST respect UTF-8 code point boundaries, and SHOULD respect <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>.
+The resulting truncated value MAY be shorter than the chosen size limit
+but MUST NOT be shorter than the longest prefix substring that satisfies the size limit and ends on a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> boundary.</p>
+   <p>The client MAY let the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> perform the truncation if it satisfies these requirements;
+otherwise the client MUST perform the truncation before relaying the string value to the authenticator.</p>
+   <p>In addition to the above, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticators</a>, user agents SHOULD:</p>
    <ol>
     <li data-md>
      <p>Ensure that any strings sent to authenticators are validly encoded.</p>
     <li data-md>
      <p>Handle the case where strings have been truncated resulting in an invalid encoding. For example, any partial code point at the end may be dropped or replaced with <a href="http://unicode.org/cldr/utility/character.jsp?a=FFFD">U+FFFD</a>.</p>
    </ol>
+   <h5 class="heading settled" data-level="6.4.1.2" id="sctn-strings-truncation-authenticator"><span class="secno">6.4.1.2. </span><span class="content">String Truncation by Authenticators</span><a class="self-link" href="#sctn-strings-truncation-authenticator"></a></h5>
+   <p>Because a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a> may be implemented in a constrained environment,
+the requirements on authenticators are relaxed compared to those for <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">clients</a>.</p>
+   <p>When a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticator</a> truncates a string,
+the truncation behaviour MUST satisfy the following requirements:</p>
+   <p>Choose a size limit equal to or greater than the specified minimum supported length.
+The string MAY be truncated so that its length in bytes in the UTF-8 character encoding satisfies that limit.
+This truncation SHOULD respect UTF-8 code point boundaries, and MAY respect <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster④">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>.
+The resulting truncated value MAY be shorter than the chosen size limit
+but MUST NOT be shorter than the longest prefix substring that satisfies the size limit and ends on a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster⑤">grapheme cluster</a> boundary.</p>
    <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span class="secno">6.4.2. </span><span class="content">Language and Direction Encoding</span><a class="self-link" href="#sctn-strings-langdir"></a></h4>
-   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
+   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
    <p>To encode language and direction metadata in a string that is documented as permitting it, suffix its code points with two sequences of code points:</p>
    <p>The first encodes a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1①">language tag</a> with the code point U+E0001 followed by the ASCII values of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1②">language tag</a> each shifted up by U+E0000. For example, the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1③">language tag</a> “en-US” becomes the code points U+E0001, U+E0065, U+E006E, U+E002D, U+E0055, U+E0053.</p>
    <p>The second consists of a single code point which is either U+200E (“LEFT-TO-RIGHT MARK”), U+200F (“RIGHT-TO-LEFT MARK”), or U+E007F (“CANCEL TAG”). The first two can be used to indicate directionality but SHOULD only be used when neccessary to produce the correct result. (E.g. an RTL string that starts with LTR-strong characters.) The value U+E007F is a direction-agnostic indication of the end of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1④">language tag</a>.</p>
    <p>So the string “حبیب الرحمان” could have two different DOMString values, depending on whether the language was encoded or not. (Since the direction is unambiguous a directionality marker is not needed in this example.)</p>
    <ul>
     <li data-md>
-     <p>Unadorned string: U+FEA2, U+FE92, U+FBFF, U+FE91, U+20, U+FE8E, U+FEDF, U+FEAE, U+FEA4, U+FEE3, U+FE8E, U+FEE7</p>
+     <p>Unadorned string: U+062D, U+0628, U+06CC, U+0628, U+0020, U+0627, U+0644, U+0631, U+062D, U+0645, U+0627, U+0646</p>
     <li data-md>
-     <p>With language “ar-SA” encoded: U+FEA2, U+FE92, U+FBFF, U+FE91, U+20, U+FE8E, U+FEDF, U+FEAE, U+FEA4, U+FEE3, U+FE8E, U+FEE7, U+E0001, U+E0061, U+E0072, U+E002D, U+E0053, U+E0041, U+E007F</p>
+     <p>With language “ar-SA” encoded: U+062D, U+0628, U+06CC, U+0628, U+0020, U+0627, U+0644, U+0631, U+062D, U+0645, U+0627, U+0646, U+E0001, U+E0061, U+E0072, U+E002D, U+E0053, U+E0041, U+E007F</p>
    </ul>
    <p>Consumers of strings that may have language and direction encoded should be aware that truncation could truncate a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1⑤">language tag</a> into a different, but still valid, language. The final directionality marker or CANCEL TAG code point provide an unambigous indication of truncation.</p>
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, if possible.
-If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> can
-produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, if possible.
+If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a> can
+produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
 enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
-or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
-   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
+or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑧">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
 for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a>.</p>
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
-    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
-    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a>.</figcaption>
+    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential
+    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a>.</figcaption>
    </figure>
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③">attestation statement
   formats</a> are defined in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. </div>
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①②">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
-data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a> that created it. It
+data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
-attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
+attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
-bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a>. In other words, this defines the
+bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a>. In other words, this defines the
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format④">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
-     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, after verifying that it
+     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statements</a> and their underlying trust models.
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑤">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
 "packed" <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑥">attestation statement format</a> defined in <a href="#sctn-packed-attestation">§ 8.2 Packed Attestation Statement Format</a> can be used in conjunction with all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②">attestation
 types</a>, while other formats and types have more limited applicability.</p>
-   <p>The privacy, security and operational characteristics of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑨">attestation</a> depend on:</p>
+   <p>The privacy, security and operational characteristics of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a> depend on:</p>
    <ul>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type③">attestation type</a>, which determines the trust model,</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestation</a> by limiting what can be
-expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a>, and</p>
+     <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a> by limiting what can be
+expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, and</p>
     <li data-md>
-     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a>, such as its construction, whether part or all of it runs in a secure
+     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
-   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
+   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
 formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Parties</a> will also need to
-understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
+understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data"><span class="secno">6.5.1. </span><span class="content">Attested Credential Data</span><a class="self-link" href="#sctn-attested-credential-data"></a></h4>
    <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
 object</a> for a credential. Its format is shown in <a href="#table-attestedCredentialData">Table <span class="table-ref-following"></span></a>.</p>
@@ -5524,20 +6044,20 @@ <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialid">credentialId</dfn>
        <td>L
-       <td><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">Credential ID</a>
+       <td><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑦">Credential ID</a>
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</dfn>
        <td>variable
        <td> The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑦">credential public key</a> encoded in COSE_Key format,
                 as defined in <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7①">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, using the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form③">CTAP2 canonical CBOR encoding form</a>.
                 The COSE_Key-encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑧">credential public key</a> MUST contain the "alg" parameter and MUST NOT
-                contain any other OPTIONAL parameters. The "alg" parameter MUST contain a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code> value.
+                contain any other OPTIONAL parameters. The "alg" parameter MUST contain a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①③">COSEAlgorithmIdentifier</a></code> value.
                 The encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑨">credential public key</a> MUST also contain any additional REQUIRED parameters stipulated by the
                 relevant key type specification, i.e., REQUIRED for the key type "kty" and algorithm "alg"
                 (see <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#section-2" id="ref-for-section-2">Section 2</a> of <a data-link-type="biblio" href="#biblio-rfc9053" title="CBOR Object Signing and Encryption (COSE): Initial Algorithms">[RFC9053]</a>). 
     </table>
-    <figcaption> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">Attested credential data</a> layout. The names in the Name column are only for reference within this document, and are not
-        present in the actual representation of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①②">attested credential data</a>. </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">Attested credential data</a> layout. The names in the Name column are only for reference within this document, and are not
+        present in the actual representation of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">attested credential data</a>. </figcaption>
    </figure>
    <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-examples"><span class="secno">6.5.1.1. </span><span class="content">Examples of <code>credentialPublicKey</code> Values Encoded in COSE_Key Format</span><a class="self-link" href="#sctn-encoded-credPubKey-examples"></a></h5>
    <p>This section provides examples of COSE_Key-encoded Elliptic Curve and RSA public keys for the ES256, PS256, and RS256
@@ -5549,53 +6069,53 @@ <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-exa
 on the P-256 curve, to be used with the ES256 signature
 algorithm (ECDSA w/ SHA-256, see <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#section-2.1" id="ref-for-section-2.1⑥">Section 2.1</a> of <a data-link-type="biblio" href="#biblio-rfc9053" title="CBOR Object Signing and Encryption (COSE): Initial Algorithms">[RFC9053]</a>):</p>
 <pre class="example highlight" id="example-bdbd14cc"><a class="self-link" href="#example-bdbd14cc"></a><c- p>{</c->
-  <c- mi>1</c-><c- p>:</c->   <c- mi>2</c-><c- p>,</c->  ; k<c- kc>t</c->y<c- p>:</c-> EC<c- mi>2</c-> key <c- kc>t</c->ype
-  <c- mi>3</c-><c- p>:</c->  <c- mi>-7</c-><c- p>,</c->  ; alg<c- p>:</c-> ES<c- mi>256</c-> sig<c- kc>nature</c-> algori<c- kc>t</c->hm
- <c- mi>-1</c-><c- p>:</c->   <c- mi>1</c-><c- p>,</c->  ; crv<c- p>:</c-> P<c- mi>-256</c-> curve
- <c- mi>-2</c-><c- p>:</c->   x<c- p>,</c->  ; x<c- mi>-</c->coordi<c- kc>nate</c-> as by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>32</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ; e.g.<c- p>,</c-> i<c- kc>n</c-> hex<c- p>:</c-> <c- mf>65e</c->da<c- mi>5</c->a<c- mi>12577</c->c<c- mi>2</c->bae<c- mi>829437</c-><c- kc>fe</c-><c- mi>338701</c->a<c- mi>10</c->aaa<c- mf>375e1</c->bb<c- mi>5</c->b<c- mi>5</c->de<c- mi>108</c->de<c- mi>439</c->c<c- mi>08551</c->d
- <c- mi>-3</c-><c- p>:</c->   y   ; y<c- mi>-</c->coordi<c- kc>nate</c-> as by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>32</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ; e.g.<c- p>,</c-> i<c- kc>n</c-> hex<c- p>:</c-> <c- mf>1e52e</c->d<c- mi>75701163</c-><c- kc>f</c-><c- mi>7</c-><c- kc>f</c-><c- mf>9e40</c->dd<c- kc>f</c-><c- mi>9</c-><c- kc>f</c-><c- mi>341</c->b<c- mi>3</c->dc<c- mi>9</c->ba<c- mi>860</c->a<c- kc>f</c-><c- mf>7e0</c->ca<c- mi>7</c->ca<c- mf>7e9ee</c->cd<c- mi>0084</c->d<c- mi>19</c->c
+  <c- mi>1</c-><c- p>:</c->   <c- mi>2</c-><c- p>,</c->  <c- c1>; kty: EC2 key type</c->
+  <c- mi>3</c-><c- p>:</c->  <c- mi>-7</c-><c- p>,</c->  <c- c1>; alg: ES256 signature algorithm</c->
+ <c- mi>-1</c-><c- p>:</c->   <c- mi>1</c-><c- p>,</c->  <c- c1>; crv: P-256 curve</c->
+ <c- mi>-2</c-><c- p>:</c->   <c- nc>x</c-><c- p>,</c->  <c- c1>; x-coordinate as byte string 32 bytes in length</c->
+           <c- c1>; e.g., in hex: 65eda5a12577c2bae829437fe338701a10aaa375e1bb5b5de108de439c08551d</c->
+ <c- mi>-3</c-><c- p>:</c->   <c- nc>y</c->   <c- c1>; y-coordinate as byte string 32 bytes in length</c->
+           <c- c1>; e.g., in hex: 1e52ed75701163f7f9e40ddf9f341b3dc9ba860af7e0ca7ca7e9eecd0084d19c</c->
 <c- p>}</c->
 </pre>
    <p>Below is the above Elliptic Curve public key encoded in the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form④">CTAP2 canonical CBOR encoding form</a>, whitespace and line breaks
 are included here for clarity and to match the CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> presentation above:</p>
-<pre class="example highlight" id="example-08d0b440"><a class="self-link" href="#example-08d0b440"></a>A<c- mi>5</c->
-   <c- mi>01</c->  <c- mi>02</c->
+<pre class="example" id="example-08d0b440"><a class="self-link" href="#example-08d0b440"></a>A5
+   01  02
 
-   <c- mi>03</c->  <c- mi>26</c->
+   03  26
 
-   <c- mi>20</c->  <c- mi>01</c->
+   20  01
 
-   <c- mi>21</c->  <c- mi>58</c-> <c- mi>20</c->   <c- mf>65e</c->da<c- mi>5</c->a<c- mi>12577</c->c<c- mi>2</c->bae<c- mi>829437</c-><c- kc>fe</c-><c- mi>338701</c->a<c- mi>10</c->aaa<c- mf>375e1</c->bb<c- mi>5</c->b<c- mi>5</c->de<c- mi>108</c->de<c- mi>439</c->c<c- mi>08551</c->d
+   21  58 20   65eda5a12577c2bae829437fe338701a10aaa375e1bb5b5de108de439c08551d
 
-   <c- mi>22</c->  <c- mi>58</c-> <c- mi>20</c->   <c- mf>1e52e</c->d<c- mi>75701163</c-><c- kc>f</c-><c- mi>7</c-><c- kc>f</c-><c- mf>9e40</c->dd<c- kc>f</c-><c- mi>9</c-><c- kc>f</c-><c- mi>341</c->b<c- mi>3</c->dc<c- mi>9</c->ba<c- mi>860</c->a<c- kc>f</c-><c- mf>7e0</c->ca<c- mi>7</c->ca<c- mf>7e9ee</c->cd<c- mi>0084</c->d<c- mi>19</c->c
+   22  58 20   1e52ed75701163f7f9e40ddf9f341b3dc9ba860af7e0ca7ca7e9eecd0084d19c
 </pre>
    <p>Below is an example of a COSE_Key-encoded 2048-bit RSA public key (see <a data-link-type="biblio" href="#biblio-rfc8230" title="Using RSA Algorithms with CBOR Object Signing and Encryption (COSE) Messages">[RFC8230]</a> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8230#section-4" id="ref-for-section-4">Section 4</a>,
 to be used with the PS256 signature algorithm
 (RSASSA-PSS with SHA-256, see <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8230#section-2" id="ref-for-section-2①">Section 2</a> of <a data-link-type="biblio" href="#biblio-rfc8230" title="Using RSA Algorithms with CBOR Object Signing and Encryption (COSE) Messages">[RFC8230]</a>:</p>
 <pre class="example highlight" id="example-fb934e19"><a class="self-link" href="#example-fb934e19"></a><c- p>{</c->
-  <c- mi>1</c-><c- p>:</c->   <c- mi>3</c-><c- p>,</c->  ; k<c- kc>t</c->y<c- p>:</c-> RSA key <c- kc>t</c->ype
-  <c- mi>3</c-><c- p>:</c-> <c- mi>-37</c-><c- p>,</c->  ; alg<c- p>:</c-> PS<c- mi>256</c->
- <c- mi>-1</c-><c- p>:</c->   <c- kc>n</c-><c- p>,</c->  ; <c- kc>n</c-><c- p>:</c->   RSA modulus <c- kc>n</c-> by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>256</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ;      e.g.<c- p>,</c-> i<c- kc>n</c-> hex (middle by<c- kc>tes</c-> elided <c- kc>f</c->or brevi<c- kc>t</c->y)<c- p>:</c-> DB<c- mi>5</c->F<c- mf>651550...6</c->DC<c- mi>6548</c->ACC<c- mi>3</c->
- <c- mi>-2</c-><c- p>:</c->   e   ; e<c- p>:</c->   RSA public expo<c- kc>nent</c-> e by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>3</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ;      e.g.<c- p>,</c-> i<c- kc>n</c-> hex<c- p>:</c-> <c- mi>010001</c->
+  <c- mi>1</c-><c- p>:</c->   <c- mi>3</c-><c- p>,</c->  <c- c1>; kty: RSA key type</c->
+  <c- mi>3</c-><c- p>:</c-> <c- mi>-37</c-><c- p>,</c->  <c- c1>; alg: PS256</c->
+ <c- mi>-1</c-><c- p>:</c->   <c- nc>n</c-><c- p>,</c->  <c- c1>; n:   RSA modulus n byte string 256 bytes in length</c->
+           <c- c1>;      e.g., in hex (middle bytes elided for brevity): DB5F651550...6DC6548ACC3</c->
+ <c- mi>-2</c-><c- p>:</c->   <c- nc>e</c->   <c- c1>; e:   RSA public exponent e byte string 3 bytes in length</c->
+           <c- c1>;      e.g., in hex: 010001</c->
 <c- p>}</c->
 </pre>
    <p>Below is an example of the same COSE_Key-encoded RSA public key as above,
 to be used with the RS256 signature algorithm (RSASSA-PKCS1-v1_5 with SHA-256):</p>
 <pre class="example highlight" id="example-8dfabc00"><a class="self-link" href="#example-8dfabc00"></a><c- p>{</c->
-  <c- mi>1</c-><c- p>:</c->   <c- mi>3</c-><c- p>,</c->  ; k<c- kc>t</c->y<c- p>:</c-> RSA key <c- kc>t</c->ype
-  <c- mi>3</c-><c- p>:</c-><c- mi>-257</c-><c- p>,</c->  ; alg<c- p>:</c-> RS<c- mi>256</c->
- <c- mi>-1</c-><c- p>:</c->   <c- kc>n</c-><c- p>,</c->  ; <c- kc>n</c-><c- p>:</c->   RSA modulus <c- kc>n</c-> by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>256</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ;      e.g.<c- p>,</c-> i<c- kc>n</c-> hex (middle by<c- kc>tes</c-> elided <c- kc>f</c->or brevi<c- kc>t</c->y)<c- p>:</c-> DB<c- mi>5</c->F<c- mf>651550...6</c->DC<c- mi>6548</c->ACC<c- mi>3</c->
- <c- mi>-2</c-><c- p>:</c->   e   ; e<c- p>:</c->   RSA public expo<c- kc>nent</c-> e by<c- kc>te</c-> s<c- kc>tr</c->i<c- kc>n</c->g <c- mi>3</c-> by<c- kc>tes</c-> i<c- kc>n</c-> le<c- kc>n</c->g<c- kc>t</c->h
-           ;      e.g.<c- p>,</c-> i<c- kc>n</c-> hex<c- p>:</c-> <c- mi>010001</c->
+  <c- mi>1</c-><c- p>:</c->   <c- mi>3</c-><c- p>,</c->  <c- c1>; kty: RSA key type</c->
+  <c- mi>3</c-><c- p>:</c-><c- mi>-257</c-><c- p>,</c->  <c- c1>; alg: RS256</c->
+ <c- mi>-1</c-><c- p>:</c->   <c- nc>n</c-><c- p>,</c->  <c- c1>; n:   RSA modulus n byte string 256 bytes in length</c->
+           <c- c1>;      e.g., in hex (middle bytes elided for brevity): DB5F651550...6DC6548ACC3</c->
+ <c- mi>-2</c-><c- p>:</c->   <c- nc>e</c->   <c- c1>; e:   RSA public exponent e byte string 3 bytes in length</c->
+           <c- c1>;      e.g., in hex: 010001</c->
 <c- p>}</c->
 </pre>
    <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><span class="secno">6.5.2. </span><span class="content">Attestation Statement Formats</span><a class="self-link" href="#sctn-attestation-formats"></a></h4>
-   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
+   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
 template:</p>
    <ul>
     <li data-md>
@@ -5603,18 +6123,18 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
     <li data-md>
      <p><strong>Supported <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑦">attestation types</a>:</strong></p>
     <li data-md>
-     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> for the extension point <code>$attStmtFormat</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
+     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> for the extension point <code>$$attStmtType</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signing-procedure">Signing procedure</dfn>:
-The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
-the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">public key credential</a> to be attested, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④②">authenticator data</a> structure containing the <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authenticator data for the attestation" data-noexport id="authenticator-data-for-the-attestation">authenticator data
+The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
+the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credential</a> to be attested, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④②">authenticator data</a> structure containing the <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authenticator data for the attestation" data-noexport id="authenticator-data-for-the-attestation">authenticator data
 for the attestation</dfn>, and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">hash of the serialized client data</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure">Verification procedure</dfn>:
-The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
+The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
      <ul>
       <li data-md>
-       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statement</a> structure</p>
+       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statement</a> structure</p>
       <li data-md>
        <p><var>authenticatorData</var>: The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data-claimed-to-have-been-used-for-the-attestation"><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④③">authenticator data</a> claimed to have been used for the attestation</dfn></p>
       <li data-md>
@@ -5631,13 +6151,13 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
    </ul>
    <p>The initial list of specified <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①③">attestation statement formats</a> is in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>.</p>
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span class="secno">6.5.3. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
-   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statements</a> and their underlying trust
+   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
-calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
 section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
-matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 24</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
-Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is acceptable
+matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 23</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
+Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑨">attestation</a> is acceptable
 under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
@@ -5652,20 +6172,20 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span
 Authenticators without meaningful protection measures for an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key②">attestation private key</a> typically use this attestation type.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-ca">Attestation CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attca">AttCA</dfn>)
     <dd data-md>
-     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
-"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> can generate multiple
+     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
+"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
-for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> can limit the exposure of the EK (which is a global correlation
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
-    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a>.</p>
+    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a>.</p>
     <dt data-md>No attestation statement (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="none">None</dfn>)
     <dd data-md>
      <p>In this case, no attestation information is available. See also <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a>.</p>
@@ -5683,7 +6203,7 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-generating-an-attestatio
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">hash of the serialized client data</a>.</p>
    </dl>
-   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticator</a> MUST:</p>
+   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> MUST:</p>
    <ol>
     <li data-md>
      <p>Let <var>attStmt</var> be the result of running <var>attestationFormat</var>’s <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure①">signing procedure</a> given <var>authData</var> and <var>hash</var>.</p>
@@ -5693,17 +6213,21 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-generating-an-attestatio
      <p>Return the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑤">attestation object</a> as a CBOR map with the following syntax, filled in with variables initialized by this
 algorithm:</p>
 <pre>attObj = {
-            authData: bytes,
-            $$attStmtType
-         }
+    authData: bytes,
 
-attStmtTemplate = (
-                      fmt: text,
-                      attStmt: { * tstr => any } ; Map is filled in by each concrete attStmtType
-                  )
+    ; Each choice in $$attStmtType defines the fmt value and attStmt structure
+    $$attStmtType
+} .within attStmtTemplate
 
-; Every attestation statement format must have the above fields
-attStmtTemplate .within $$attStmtType
+attStmtTemplate = {
+    authData: bytes,
+    fmt: text,
+    attStmt: (
+      { * tstr => any } ; Map is filled in by each concrete attStmtType
+      //
+      [ * any ]         ; attStmt may also be an array
+    )
+}
 </pre>
    </ol>
    <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-types"><span class="secno">6.5.5. </span><span class="content">Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures</span><a class="self-link" href="#sctn-signature-attestation-types"></a></h4>
@@ -5719,7 +6243,7 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
     |  4e 72 23 6e a3 90 a9 a1  7b cf 5f 7a 09 d6 3a b2
     |  17 6c 92 bb 8e 36 c0 41  98 a2 7b 90 9b 6e 8f 13
 </pre>
-     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
    </ul>
    <p>It is RECOMMENDED that any new attestation formats defined not use ASN.1 encodings,
     but instead represent signatures as equivalent fixed-length byte arrays without internal structure,
@@ -5735,24 +6259,25 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 RSASSA-PSS signature scheme defined in Section 8.1.1 of <a data-link-type="biblio" href="#biblio-rfc8017" title="PKCS #1: RSA Cryptography Specifications Version 2.2">[RFC8017]</a> with SHA-256 as the hash function.
 The signature is not ASN.1 wrapped.</p>
    </ul>
-   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a>'s script receives
-a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
+   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a>'s script receives
+a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③⓪">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
 respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> server, using methods outside
 the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions③">CredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a>'s needs for the ceremony.
+Let <var>pkOptions</var> be <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code>.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">navigator.credentials.create()</a></code> and pass <var>options</var> as the argument.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as
 might be determinable from the context available in the rejected promise. For example if the promise is rejected with
-an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a>.
+an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑤">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticator</a>.
 For information on different error contexts and the circumstances leading to them, see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>.</p>
     <li data-md>
      <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑤">response</a></code></code>.
@@ -5773,18 +6298,22 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑦">type</a></code></code> is <code>webauthn.create</code>.</p>
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
-the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
-    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>.
+the base64url encoding of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
+    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
-     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑦">crossOrigin</a></code></code> is present and set to <code>true</code>,
+verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> expects that this credential would have been created within an iframe
+that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
+    <li data-md>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> expects that this credential would have been created within an iframe that is
-not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> expects that this credential would have been created within an iframe that is
+not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> expects to be sub-framed within.
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li data-md>
@@ -5792,31 +6321,21 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑤">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a>.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set, unless <code><var>options</var>.<code class="idl"><a data-link-type="idl">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑥">conditional</a></code>.</p>
+     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑦">mediation</a></code></code> is not set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code>,
+verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a> for this registration,
-verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> for this registration,
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit is not set.</p>
+     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
-    <li id="reg-ceremony-verify-extension-outputs">
-     <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
-    outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> can make this
-    decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> MUST also be
-    prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys①">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-create">§ 10.2.2.3.1 Registration (create())</a>.</p>
+     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑥">pubKeyCredParams</a></code></code>.</p>
     <li data-md>
      <p>Determine the attestation statement format by performing a USASCII case-sensitive match on <var>fmt</var> against the set of
 supported WebAuthn Attestation Statement Format Identifier values.
@@ -5824,32 +6343,35 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
 is maintained in the
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
     <li id="reg-ceremony-verify-attestation">
-     <a class="self-link" href="#reg-ceremony-verify-attestation"></a> Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>. 
+     <a class="self-link" href="#reg-ceremony-verify-attestation"></a> Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>. 
      <p class="note" role="note"><span class="marker">Note:</span> Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑥">attestation statement format</a> specifies its own <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure④">verification procedure</a>. See <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a> for
     the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
     <li id="reg-ceremony-attestation-trust-anchors"><a class="self-link" href="#reg-ceremony-attestation-trust-anchors"></a> If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates)
     for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. For
-    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
+    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
     <li id="reg-ceremony-assess-trust">
-     <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 22</a>, as follows: 
+     <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 21</a>, as follows: 
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate
-(i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">step 23</a> may be the same).</p>
+(i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> may be the same).</p>
      </ul>
-    <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
-    <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
-    <li id="reg-ceremony-store-credential-record">
-     <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
-    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
-    with the following contents: 
+     <p>If the attestation statement is not deemed trustworthy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential ID</a> and credential public key but treat the
+        credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> is asserting there
+        is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a> model.
+        See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
+    <li data-md>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
+    <li data-md>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+    <li id="reg-ceremony-create-credential-record">
+     <a class="self-link" href="#reg-ceremony-create-credential-record"></a> Let <var>credentialRecord</var> be a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> with the following contents: 
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type②">type</a>
       <dd data-md>
@@ -5857,7 +6379,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
-whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a>.</p>
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-publickey" id="ref-for-abstract-opdef-credential-record-publickey">publicKey</a>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
@@ -5866,18 +6388,18 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
        <p><code><var>authData</var>.<a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑤">signCount</a></code>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized②">uvInitialized</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flag</a> in <var>authData</var>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports②">transports</a>
       <dd data-md>
        <p>The value returned from <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code></code>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible">backupEligible</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flag</a> in <var>authData</var>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate">backupState</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a> in <var>authData</var>.</p>
      </dl>
-     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> MAY also include the following OPTIONAL contents:</p>
+     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> MAY also include the following OPTIONAL contents:</p>
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject①">attestationObject</a>
       <dd data-md>
@@ -5886,26 +6408,39 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dd data-md>
        <p><code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑨">clientDataJSON</a></code></code>.</p>
      </dl>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">items</a> as necessary.
+    As a non-normative example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> might allow the user to set a "nickname" for the credential
+    to help the user remember which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credential</a> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to which <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a> when interacting with account settings.</p>
+    <li id="reg-ceremony-verify-extension-outputs">
+     <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a>.
+    Depending on each <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">extension</a>,
+    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> what to do with extension outputs.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> MAY ignore any or all extension outputs. 
+     <p><a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">Clients</a> MAY set additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not
+    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code>.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> MUST be prepared to handle such situations,
+    whether by ignoring the unsolicited extensions or by rejecting the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> can make this
+    decision based on local policy and the extensions in use.</p>
+     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> MUST also be
+    prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li data-md>
-     <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 24</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> is asserting there
-    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> model.
-    See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
+     <p>If all the above steps are successful,
+store <var>credentialRecord</var> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code></code> and continue the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremony</a> as appropriate.
+Otherwise, fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a>.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> has a trusted method of determining acceptable trust anchors
-in <a href="#reg-ceremony-attestation-trust-anchors">step 23</a> above.
-Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> has a trusted method of determining acceptable trust anchors
+in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> above.
+Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions③">CredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a>'s needs for the ceremony.
+Let <var>pkOptions</var> be <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code>.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">navigator.credentials.get()</a></code> and pass <var>options</var> as the argument.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as might
 be determinable from the context available in the rejected promise. For information on different error contexts and the
@@ -5916,22 +6451,22 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults③">getClientExtensionResults()</a></code></code>.</p>
     <li data-md>
-     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①③">is not empty</a>,
-verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code></code>.</p>
+     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①③">is not empty</a>,
+verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credentials</a> listed in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code></code>.</p>
     <li data-md>
-     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>:</p>
+     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credential</a>:</p>
      <dl class="switch">
-      <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a> was initiated, e.g., via a username or cookie,
+      <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication ceremony</a> was initiated, e.g., via a username or cookie,
       <dd data-md>
-       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a>.
+       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a>.
 If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
 verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a>.</p>
-      <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremony</a> was initiated,
+      <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> was initiated,
       <dd data-md>
        <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is present.
-Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id④">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑦">credential record</a>.</p>
+Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id④">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a>.</p>
      </dl>
     <li data-md>
      <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①⓪">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata②">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
@@ -5948,35 +6483,38 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑧">type</a></code></code> is the string <code>webauthn.get</code>.</p>
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
-the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a>.
+the base64url encoding of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
-     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑧">crossOrigin</a></code></code> is present and set to <code>true</code>,
+verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑥">same-origin with its ancestors</a>.</p>
+    <li data-md>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑦">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> expects to be sub-framed within.
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a>. 
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.</p>
+     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>Determine whether <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> is required for this assertion. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">User verification</a> SHOULD be required if, and only if, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑥">required</a></code>.</p>
-     <p>If <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">user verification</a> was determined to be required,
-verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flags</a></code> in <var>authData</var> is set.
-Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a>.</p>
+     <p>Determine whether <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">user verification</a> is required for this assertion. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">User verification</a> SHOULD be required if, and only if, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑦">required</a></code>.</p>
+     <p>If <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a> was determined to be required,
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var> is set.
+Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit is not set.</p>
+     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> business logic or policy,
-let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> bits, respectively,
-of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var>.
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> business logic or policy,
+let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> bits, respectively,
+of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flags</a></code> in <var>authData</var>.
 Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code>:</p>
      <ol>
       <li data-md>
@@ -5984,20 +6522,9 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible③">backupEligible</a></code> is not set, verify that <var>currentBe</var> is not set.</p>
       <li data-md>
-       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> policy, if any.</p>
+       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> policy, if any.</p>
      </ol>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
-    <li id="authn-ceremony-verify-extension-outputs">
-     <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
-    outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> can make this
-    decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> MUST also be
-    prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys②">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-get">§ 10.2.2.3.2 Authentication (get())</a>.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> values.</p>
     <li data-md>
      <p>Let <var>hash</var> be the result of computing a hash over the <var>cData</var> using SHA-256.</p>
     <li data-md>
@@ -6014,14 +6541,33 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
         <dt>greater than <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount②">signCount</a></code>:
         <dd>The signature counter is valid.
         <dt>less than or equal to <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount③">signCount</a></code>:
-        <dd>This is a signal that
-          the authenticator may be cloned, i.e. at least
-          two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private key</a> may exist and are
-          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Parties</a> should incorporate this information
-          into their risk scoring.
-          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a>-specific. 
+        <dd>
+         This is a signal, but not proof, that the authenticator may be cloned. For example it might mean that: 
+         <ul>
+          <li data-md>
+           <p>Two or more copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private key</a> may exist and are being used in parallel.</p>
+          <li data-md>
+           <p>An authenticator is malfunctioning.</p>
+          <li data-md>
+           <p>A race condition exists where the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> is processing assertion responses in an order other than the order they were generated at the authenticator.</p>
+         </ul>
+         <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Parties</a> should evaluate their own operational characteristics and incorporate this information into their risk scoring.
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a>-specific.</p>
+         <p>For more information on signature counter considerations, see <a href="#sctn-sign-counter">§ 6.1.1 Signature Counter Considerations</a>.</p>
        </dl>
      </ul>
+    <li id="authn-ceremony-verify-extension-outputs">
+     <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a>.
+    Depending on each <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①①">extension</a>,
+    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> what to do with extension outputs.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> MAY ignore any or all extension outputs. 
+     <p><a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">Clients</a> MAY set additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not
+    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code>.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> MUST be prepared to handle such situations,
+    whether by ignoring the unsolicited extensions or by rejecting the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> can make this
+    decision based on local policy and the extensions in use.</p>
+     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> MUST also be
+    prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li id="authn-ceremony-update-credential-record">
      <a class="self-link" href="#authn-ceremony-update-credential-record"></a> Update <var>credentialRecord</var> with new state values: 
      <ol>
@@ -6031,14 +6577,14 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
        <p>Update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate②">backupState</a></code> to the value of <var>currentBs</var>.</p>
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized③">uvInitialized</a></code> is <code>false</code>,
-update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> in <var>authData</var>.
-This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>;
+update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flags</a> in <var>authData</var>.
+This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>;
 if not authorized, skip this step.</p>
      </ol>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a> steps,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremony</a> steps,
     the above state updates SHOULD be deferred to after those additional checks are completed successfully.</p>
     <li data-md>
-     <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>.</p>
+     <p>If all the above steps are successful, continue the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>.</p>
    </ol>
    <h2 class="heading settled" data-level="8" id="sctn-defined-attestation-formats"><span class="secno">8. </span><span class="content">Defined Attestation Statement Formats</span><a class="self-link" href="#sctn-defined-attestation-formats"></a></h2>
    <p>WebAuthn supports pluggable attestation statement formats. This section defines an initial set of such formats.</p>
@@ -6061,7 +6607,7 @@ <h3 class="heading settled" data-level="8.1" id="sctn-attstn-fmt-ids"><span clas
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
    <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span class="secno">8.2. </span><span class="content">Packed Attestation Statement Format</span><a class="self-link" href="#sctn-packed-attestation"></a></h3>
    <p>This is a WebAuthn optimized attestation statement format. It uses a very compact but still extensible encoding method. It is
-implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticators</a> with limited resources (e.g., secure elements).</p>
+implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticators</a> with limited resources (e.g., secure elements).</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6091,7 +6637,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
      <dl>
       <dt data-md>alg
       <dd data-md>
-       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①③">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⓪">attestation signature</a>.</p>
+       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①④">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⓪">attestation signature</a>.</p>
       <dt data-md>sig
       <dd data-md>
        <p>A byte string containing the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①①">attestation signature</a>.</p>
@@ -6112,7 +6658,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
        <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation">authenticator data for the attestation</a>,
 and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">hash of the serialized client data</a>.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#basic" id="ref-for-basic②">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca②">AttCA</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②③">attestation</a> is in use, the authenticator produces the <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>, and signing the result using an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key③">attestation private key</a> selected through an authenticator-specific
+       <p>If <a data-link-type="dfn" href="#basic" id="ref-for-basic②">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca②">AttCA</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is in use, the authenticator produces the <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>, and signing the result using an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key③">attestation private key</a> selected through an authenticator-specific
 mechanism. It sets <var>x5c</var> to <var>attestnCert</var> followed by the related certificate chain (if any). It sets <var>alg</var> to the algorithm of the
 attestation private key.</p>
       <li data-md>
@@ -6135,10 +6681,10 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
          <p>Verify that <var>sig</var> is a valid signature over the concatenation of <var>authenticatorData</var> and <var>clientDataHash</var> using the
 attestation public key in <var>attestnCert</var> with the algorithm specified in <var>alg</var>.</p>
         <li data-md>
-         <p>Verify that <var>attestnCert</var> meets the requirements in <a href="#sctn-packed-attestation-cert-requirements">§ 8.2.1 Packed Attestation Statement Certificate Requirements</a>.</p>
+         <p>Verify that <var>attestnCert</var> meets the requirements in <a href="#sctn-packed-attestation-cert-requirements">§ 8.2.1 Certificate Requirements for Packed Attestation Statements</a>.</p>
         <li data-md>
          <p>If <var>attestnCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the
-value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">aaguid</a></code> in <var>authenticatorData</var>.</p>
+value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">aaguid</a></code> in <var>authenticatorData</var>.</p>
         <li data-md>
          <p>Optionally, inspect <var>x5c</var> and consult externally provided knowledge to determine whether <var>attStmt</var> conveys a <a data-link-type="dfn" href="#basic" id="ref-for-basic③">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca③">AttCA</a> attestation.</p>
         <li data-md>
@@ -6158,7 +6704,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
        </ul>
      </ol>
    </dl>
-   <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-requirements"><span class="secno">8.2.1. </span><span class="content">Packed Attestation Statement Certificate Requirements</span><a class="self-link" href="#sctn-packed-attestation-cert-requirements"></a></h4>
+   <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-requirements"><span class="secno">8.2.1. </span><span class="content">Certificate Requirements for Packed Attestation Statements</span><a class="self-link" href="#sctn-packed-attestation-cert-requirements"></a></h4>
    <p>The attestation certificate MUST have the following fields/extensions:</p>
    <ul>
     <li data-md>
@@ -6182,8 +6728,8 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
     <li data-md>
      <p>If the related attestation root certificate is used for multiple authenticator models, the Extension OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) MUST be present, containing the AAGUID as a 16-byte OCTET STRING.
 The extension MUST NOT be marked as critical.</p>
-     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> may not know if the attestation root
-certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Parties</a> check if the extension
+     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> may not know if the attestation root
+certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Parties</a> check if the extension
 is present, and if it is, then validate that it contains that same AAGUID as presented in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑦">attestation object</a>.</p>
      <p>Note that an X.509 Extension encodes the DER-encoding of the value in an OCTET STRING.
 Thus, the AAGUID MUST be wrapped in <i>two</i> OCTET STRINGS to be valid.</p>
@@ -6195,18 +6741,18 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
    <p>The firmware of a particular authenticator model MAY be differentiated using the Extension OID <code>1.3.6.1.4.1.45724.1.1.5</code> (<code>id-fido-gen-ce-fw-version</code>). When present, this attribute contains an INTEGER with a non-negative value which is incremented for new
     firmware release versions. The extension MUST NOT be marked as critical.</p>
    <p>For example, the following is an attestation certificate containing the above extension OIDs as well as required fields:</p>
-<pre class="language-pem highlight"><c- c>-----BEGIN</c-> <c- c>CERTIFICATE-----</c-> <c- c>&lt;!--</c-> <c- c>bikeshed</c-> <c- c>emdash</c-> <c- c>workaround</c-> <c- c>--></c->
-<c- c>MIIBzTCCAXOgAwIBAgIUYHS3FJEL/JTfFqafuAHvlAS+hDYwCgYIKoZIzj0EAwIw</c->
-<c- c>QTELMAkGA1UEBhMCVVMxFDASBgNVBAoMC1dlYkF1dGhuIFdHMRwwGgYDVQQDDBNF</c->
-<c- c>eGFtcGxlIEF0dGVzdGF0aW9uMCAXDTI0MDEwMzE3NDUyMVoYDzIwNTAwMTA2MTc0</c->
-<c- c>NTIxWjBBMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLV2ViQXV0aG4gV0cxHDAaBgNV</c->
-<c- c>BAMME0V4YW1wbGUgQXR0ZXN0YXRpb24wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC</c->
-<c- c>AATDQN9uaFFH4BKBjthHTM1drpb7gIuPod67qyF6UdL4qah6XUp6tE7Prl+DfQ7P</c->
-<c- c>YH9yMOOcci3nr+Q/jOBaWVERo0cwRTAhBgsrBgEEAYLlHAEBBAQSBBDNjDlcJu3u</c->
-<c- c>3mU7AHl9A8o8MBIGCysGAQQBguUcAQEFBAMCASowDAYDVR0TAQH/BAIwADAKBggq</c->
-<c- c>hkjOPQQDAgNIADBFAiA3k3aAUVtLhDHLXOgY2kRnK2hrbRgf2EKdTDLJ1Ds/RAIh</c->
-<c- c>AOmIblhI3ALCHOaO0IO7YlMpw/lSTvFYv3qwO3m7H8Dc</c->
-<c- c>-----END</c-> <c- c>CERTIFICATE-----</c-> <c- c>&lt;!--</c-> <c- c>bikeshed</c-> <c- c>emdash</c-> <c- c>workaround</c-> <c- c>--></c->
+<pre class="language-pem highlight">-----BEGIN CERTIFICATE-----
+<c- s>MIIBzTCCAXOgAwIBAgIUYHS3FJEL/JTfFqafuAHvlAS+hDYwCgYIKoZIzj0EAwIw</c->
+<c- s>QTELMAkGA1UEBhMCVVMxFDASBgNVBAoMC1dlYkF1dGhuIFdHMRwwGgYDVQQDDBNF</c->
+<c- s>eGFtcGxlIEF0dGVzdGF0aW9uMCAXDTI0MDEwMzE3NDUyMVoYDzIwNTAwMTA2MTc0</c->
+<c- s>NTIxWjBBMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLV2ViQXV0aG4gV0cxHDAaBgNV</c->
+<c- s>BAMME0V4YW1wbGUgQXR0ZXN0YXRpb24wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC</c->
+<c- s>AATDQN9uaFFH4BKBjthHTM1drpb7gIuPod67qyF6UdL4qah6XUp6tE7Prl+DfQ7P</c->
+<c- s>YH9yMOOcci3nr+Q/jOBaWVERo0cwRTAhBgsrBgEEAYLlHAEBBAQSBBDNjDlcJu3u</c->
+<c- s>3mU7AHl9A8o8MBIGCysGAQQBguUcAQEFBAMCASowDAYDVR0TAQH/BAIwADAKBggq</c->
+<c- s>hkjOPQQDAgNIADBFAiA3k3aAUVtLhDHLXOgY2kRnK2hrbRgf2EKdTDLJ1Ds/RAIh</c->
+<c- s>AOmIblhI3ALCHOaO0IO7YlMpw/lSTvFYv3qwO3m7H8Dc</c->
+-----END CERTIFICATE-----
 </pre>
    <p>The attributes above are structured within this certificate as such:</p>
 <pre class="language-text highlight">30 21                                    -- SEQUENCE
@@ -6222,6 +6768,8 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
     02 01                                -- INTEGER
       2A                                 -- Firmware version: 42
 </pre>
+   <h4 class="heading settled" data-level="8.2.2" id="sctn-enterprise-packed-attestation-cert-requirements"><span class="secno">8.2.2. </span><span class="content">Certificate Requirements for Enterprise Packed Attestation Statements</span><a class="self-link" href="#sctn-enterprise-packed-attestation-cert-requirements"></a></h4>
+   <p>The Extension OID <code>1.3.6.1.4.1.45724.1.1.2</code> ( <code>id-fido-gen-ce-sernum</code> ) MAY additionally be present in packed attestations for enterprise use. If present, this extension MUST indicate a unique octet string value per device against a particular AAGUID. This value MUST remain constant through factory resets, but MAY be distinct from any other serial number or other hardware identifier associated with the device. This extension MUST NOT be marked as critical, and the corresponding value is encoded as an OCTET STRING. This extension MUST NOT be present in non-enterprise attestations.</p>
    <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span class="secno">8.3. </span><span class="content">TPM Attestation Statement Format</span><a class="self-link" href="#sctn-tpm-attestation"></a></h3>
    <p>This attestation statement format is generally used by authenticators that use a Trusted Platform Module as their cryptographic
 engine.</p>
@@ -6258,7 +6806,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>The version of the TPM specification to which the signature conforms.</p>
       <dt data-md>alg
       <dd data-md>
-       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①④">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①②">attestation signature</a>.</p>
+       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①⑤">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①②">attestation signature</a>.</p>
       <dt data-md>x5c
       <dd data-md>
        <p><var>aikCert</var> followed by its certificate chain, in X.509 encoding.</p>
@@ -6282,8 +6830,10 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
      <p>Generate a signature using the procedure specified in <a data-link-type="biblio" href="#biblio-tpmv2-part3" title="Trusted Platform Module Library, Part 3: Commands">[TPMv2-Part3]</a> Section 18.2, using the attestation private key and
 setting the <code>extraData</code> parameter to the digest of <var>attToBeSigned</var> using the hash algorithm corresponding to the "alg" signature algorithm.
 (For the "RS256" algorithm, this would be a SHA-256 digest.)</p>
-     <p>Set the <var>pubArea</var> field to the public area of the credential public key, the <var>certInfo</var> field to the output parameter of the
-same name, and the <var>sig</var> field to the signature obtained from the above procedure.</p>
+     <p>Set the <var>pubArea</var> field to the public area of the credential public key (the TPMT_PUBLIC structure), the <var>certInfo</var> field (the TPMS_ATTEST structure)
+to the output parameter of the same name, and the <var>sig</var> field to the signature obtained from the above procedure.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> If the <var>pubArea</var> is read from the TPM using the TPM2_ReadPublic command, that command returns a TPM2B_PUBLIC structure. TPM2B_PUBLIC
+is two bytes of length followed by the TPMT_PUBLIC structure. The two bytes of length must be removed prior to putting this into the <var>pubArea</var>.</p>
     <dt data-md>Verification procedure
     <dd data-md>
      <p>Given the <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs①">verification procedure inputs</a> <var>attStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>, the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑧">verification procedure</a> is
@@ -6292,31 +6842,36 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
 contained fields.</p>
      <p>Verify that the public key specified by the <code>parameters</code> and <code>unique</code> fields of <var>pubArea</var> is identical to the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑦">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑧">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
      <p>Concatenate <var>authenticatorData</var> and <var>clientDataHash</var> to form <var>attToBeSigned</var>.</p>
-     <p>Validate that <var>certInfo</var> is valid:</p>
+     <p>Verify integrity of <var>certInfo</var></p>
      <ul>
-      <li data-md>
-       <p>Verify that <code>magic</code> is set to <code>TPM_GENERATED_VALUE</code>.</p>
-      <li data-md>
-       <p>Verify that <code>type</code> is set to <code>TPM_ST_ATTEST_CERTIFY</code>.</p>
-      <li data-md>
-       <p>Verify that <code>extraData</code> is set to the hash of <var>attToBeSigned</var> using the hash algorithm employed in "alg".</p>
-      <li data-md>
-       <p>Verify that <code>attested</code> contains a <code>TPMS_CERTIFY_INFO</code> structure as specified in <a data-link-type="biblio" href="#biblio-tpmv2-part2" title="Trusted Platform Module Library, Part 2: Structures">[TPMv2-Part2]</a> section 10.12.3,
-whose <code>name</code> field contains a valid Name for <var>pubArea</var>,
-as computed using the algorithm in the <code>nameAlg</code> field of <var>pubArea</var> using the procedure specified in <a data-link-type="biblio" href="#biblio-tpmv2-part1" title="Trusted Platform Module Library, Part 1: Architecture">[TPMv2-Part1]</a> section 16.</p>
       <li data-md>
        <p>Verify that <var>x5c</var> is present.</p>
       <li data-md>
-       <p>Note that the remaining fields in the "Standard Attestation Structure" <a data-link-type="biblio" href="#biblio-tpmv2-part1" title="Trusted Platform Module Library, Part 1: Architecture">[TPMv2-Part1]</a> section 31.2, i.e., <code>qualifiedSigner</code>, <code>clockInfo</code> and <code>firmwareVersion</code> are ignored.
-These fields MAY be used as an input to risk engines.</p>
+       <p>Verify that <var>aikCert</var> meets the requirements in <a href="#sctn-tpm-cert-requirements">§ 8.3.1 TPM Attestation Statement Certificate Requirements</a>.</p>
+      <li data-md>
+       <p>If <var>aikCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the value of this
+extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">aaguid</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
        <p>Verify the <var>sig</var> is a valid signature over <var>certInfo</var> using the attestation public key in <var>aikCert</var> with the
 algorithm specified in <var>alg</var>.</p>
+     </ul>
+     <p>Validate that <var>certInfo</var> is valid:
+Note: <var>certInfo</var> is a TPMS_ATTEST structure.</p>
+     <ul>
       <li data-md>
-       <p>Verify that <var>aikCert</var> meets the requirements in <a href="#sctn-tpm-cert-requirements">§ 8.3.1 TPM Attestation Statement Certificate Requirements</a>.</p>
+       <p>Verify that <code>magic</code> is set to <code>TPM_GENERATED_VALUE</code>.</p>
       <li data-md>
-       <p>If <var>aikCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the value of this
-extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑥">aaguid</a></code> in <var>authenticatorData</var>.</p>
+       <p>Verify that <code>type</code> is set to <code>TPM_ST_ATTEST_CERTIFY</code>.</p>
+      <li data-md>
+       <p>Verify that <code>extraData</code> is set to the hash of <var>attToBeSigned</var> using the hash algorithm employed in "alg".</p>
+      <li data-md>
+       <p>Verify that <code>attested</code> contains a <code>TPMS_CERTIFY_INFO</code> structure as specified in <a data-link-type="biblio" href="#biblio-tpmv2-part2" title="Trusted Platform Module Library, Part 2: Structures">[TPMv2-Part2]</a> section 10.12.3,
+whose <code>name</code> field contains a valid Name for <var>pubArea</var>, as computed using the procedure specified in <a data-link-type="biblio" href="#biblio-tpmv2-part1" title="Trusted Platform Module Library, Part 1: Architecture">[TPMv2-Part1]</a> section 16 using the nameAlg in the <var>pubArea</var>.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The TPM will always return TPMS_CERTIFY_INFO structure with the same nameAlg in the <code>name</code> as the nameAlg
+in <var>pubArea</var>.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The remaining fields in the "Standard Attestation Structure" <a data-link-type="biblio" href="#biblio-tpmv2-part1" title="Trusted Platform Module Library, Part 1: Architecture">[TPMv2-Part1]</a> section 31.2, i.e., <code>qualifiedSigner</code>, <code>clockInfo</code> and <code>firmwareVersion</code> are ignored.
+Depending on the properties of the <var>aikCert</var> key used, these fields may be obfuscated.
+If valid, these MAY be used as an input to risk engines.</p>
       <li data-md>
        <p>If successful, return implementation-specific values representing <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑨">attestation type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca⑥">AttCA</a> and <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path⑤">attestation trust
 path</a> <var>x5c</var>.</p>
@@ -6331,6 +6886,9 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
      <p>Subject field MUST be set to empty.</p>
     <li data-md>
      <p>The Subject Alternative Name extension MUST be set as defined in <a data-link-type="biblio" href="#biblio-tpmv2-ek-profile" title="TCG EK Credential Profile for TPM Family 2.0">[TPMv2-EK-Profile]</a> section 3.2.9.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> Previous versions of <a data-link-type="biblio" href="#biblio-tpmv2-ek-profile" title="TCG EK Credential Profile for TPM Family 2.0">[TPMv2-EK-Profile]</a> allowed the inclusion of an optional attribute,
+    called HardwareModuleName, that contains the TPM serial number in the EK certificate.
+    HardwareModuleName SHOULD NOT be placed in in the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑦">attestation certificate</a> Subject Alternative Name.</p>
     <li data-md>
      <p>The Extended Key Usage extension MUST contain the OID <code>2.23.133.8.3</code> ("joint-iso-itu-t(2) internationalorganizations(23) 133 tcg-kp(8) tcg-kp-AIKCertificate(3)").</p>
     <li data-md>
@@ -6341,11 +6899,11 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
-produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
+produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
 the attestation</a> is consistent with the fields of the attestation certificate’s extension data.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
@@ -6392,13 +6950,13 @@ <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><
       <li data-md>
        <p>Verify that the public key in the first certificate in <var>x5c</var> matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑧">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑨">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
-       <p>Verify that the <code>attestationChallenge</code> field in the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑦">attestation certificate</a> <a data-link-type="dfn" href="#android-key-attestation-certificate-extension-data" id="ref-for-android-key-attestation-certificate-extension-data">extension data</a> is identical to <var>clientDataHash</var>.</p>
+       <p>Verify that the <code>attestationChallenge</code> field in the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a> <a data-link-type="dfn" href="#android-key-attestation-certificate-extension-data" id="ref-for-android-key-attestation-certificate-extension-data">extension data</a> is identical to <var>clientDataHash</var>.</p>
       <li data-md>
        <p>Verify the following using the appropriate authorization list from the attestation certificate <a data-link-type="dfn" href="#android-key-attestation-certificate-extension-data" id="ref-for-android-key-attestation-certificate-extension-data①">extension data</a>:</p>
        <ul>
         <li data-md>
          <p>The <code>AuthorizationList.allApplications</code> field is <em>not</em> present on either authorization list
-(<code>softwareEnforced</code> nor <code>teeEnforced</code>), since PublicKeyCredential MUST be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑥">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a>.</p>
+(<code>softwareEnforced</code> nor <code>teeEnforced</code>), since PublicKeyCredential MUST be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑥">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a>.</p>
         <li data-md>
          <p>For the following, use only the <code>teeEnforced</code> authorization list if the RP wants to accept only keys from a
 trusted execution environment, otherwise use the union of <code>teeEnforced</code> and <code>softwareEnforced</code>.</p>
@@ -6415,10 +6973,11 @@ <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><
      </ul>
    </dl>
    <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirements"><span class="secno">8.4.1. </span><span class="content">Android Key Attestation Statement Certificate Requirements</span><a class="self-link" href="#sctn-key-attstn-cert-requirements"></a></h4>
-   <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
+   <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
+   <p class="note" role="note"><span class="marker">Note:</span> This format is deprecated and is expected to be removed in a future revision of this document.</p>
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -6511,7 +7070,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
       <dt data-md>sig
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①④">attestation signature</a>.
-The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> from the authenticator.</p>
+The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> from the authenticator.</p>
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
@@ -6520,8 +7079,8 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
 and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑨">hash of the serialized client data</a>. (Since SHA-256 is used to hash the
 serialized <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①①">client data</a>, <var>clientDataHash</var> will be 32 bytes long.)</p>
      <p>Generate a Registration Response Message as specified in <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success" id="ref-for-registration-response-message-success">Section 4.3</a>, with the application parameter set to the
-SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⓪">RP ID</a> that the given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑦">scoped</a> to, the challenge parameter set to <var>clientDataHash</var>, and the key handle
-parameter set to the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑥">credential ID</a> of the given credential. Set the raw signature part of this Registration Response Message (i.e., without the <a data-link-type="dfn" href="#user-public-key" id="ref-for-user-public-key①">user public key</a>,
+SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑥">RP ID</a> that the given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑦">scoped</a> to, the challenge parameter set to <var>clientDataHash</var>, and the key handle
+parameter set to the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> of the given credential. Set the raw signature part of this Registration Response Message (i.e., without the <a data-link-type="dfn" href="#user-public-key" id="ref-for-user-public-key①">user public key</a>,
 key handle, and attestation certificates) as <var>sig</var> and set the attestation certificates of
 the attestation public key as <var>x5c</var>.</p>
     <dt data-md>Verification procedure
@@ -6566,9 +7125,9 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a> MAY also directly generate attestation statements of this format
-if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> MAY also directly generate attestation statements of this format
+if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestation</a>.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6672,7 +7231,7 @@ <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><spa
                       attStmt: [2* nonCompoundAttStmt]
                   )
 
-nonCompoundAttStmt = { $$attStmtType } .within { fmt: text .ne "compound" }
+nonCompoundAttStmt = { $$attStmtType } .within { fmt: text .ne "compound", * any => any }
 </pre>
     <dt data-md>Signing procedure
     <dd data-md>
@@ -6683,31 +7242,31 @@ <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><spa
 as follows:</p>
      <ol>
       <li data-md>
-       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①③">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
-       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> policy.</p>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①③">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
+       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
+       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
 return implementation-specific values representing any combination of outputs from successful <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedures</a>.</p>
      </ol>
    </dl>
    <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="secno">9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-extensions">WebAuthn Extensions</dfn></span><a class="self-link" href="#sctn-extensions"></a></h2>
-   <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credentials</a>, as well as requesting and generating Authentication assertions, as
+   <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a>, as well as requesting and generating Authentication assertions, as
 defined in <a href="#sctn-api">§ 5 Web Authentication API</a>, can be extended to suit particular use cases. Each case is addressed by defining a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="registration extension" data-noexport id="registration-extension">registration
 extension</dfn> and/or an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-extension">authentication extension</dfn>.</p>
    <p>Every extension is a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension">client extension</dfn>, meaning that the extension involves communication with and processing by the
 client. <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension④">Client extensions</a> define the following steps and data:</p>
    <ul>
     <li data-md>
-     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
+     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
     <li data-md>
-     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">navigator.credentials.get()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②">authentication extensions</a>.</p>
+     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">navigator.credentials.get()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②">authentication extensions</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
-   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
-(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
+   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> can request the use of a set
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call
+(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
 processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">Authenticator extensions</a> define the following steps and data:</p>
    <ul>
@@ -6718,25 +7277,25 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing②">Authenticator extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑥">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑥">authentication extensions</a>.</p>
    </ul>
-   <p>For <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑥">authenticator extensions</a>, as part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑧">client extension processing</a>, the client also creates the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①①">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑤">authenticator extension input</a> value for each extension (often based on the corresponding <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑧">client extension input</a> value),
-and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
+   <p>For <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑥">authenticator extensions</a>, as part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑧">client extension processing</a>, the client also creates the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①①">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑤">authenticator extension input</a> value for each extension (often based on the corresponding <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client extension input</a> value),
+and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
 represented in <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①②">CBOR</a> and passed as name-value pairs, with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①①">extension identifier</a> as the name, and the corresponding <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑦">authenticator extension input</a> as the value. The authenticator, in turn, performs additional processing for the extensions
 that it supports, and returns the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①③">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑦">authenticator extension output</a> for each as specified by the extension.
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①②">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> does not endanger the user’s security or privacy.
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①③">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
-that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension inputs</a> from JSON to CBOR
+that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension inputs</a> from JSON to CBOR
 will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
 being ignored by the authenticator. Since all extensions are OPTIONAL, this will not cause a functional failure in the API
 operation.</p>
    <p>The IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> can be consulted
-for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a>.</p>
+for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①④">WebAuthn Extensions</a>.</p>
    <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class="secno">9.1. </span><span class="content">Extension Identifiers</span><a class="self-link" href="#sctn-extension-id"></a></h3>
    <p>Extensions are identified by a string, called an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="extension-identifier">extension identifier</dfn>, chosen by the extension author.</p>
    <p>Extension identifiers SHOULD be registered in the
@@ -6751,27 +7310,27 @@ <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class=
    <p><a href="#sctn-defined-extensions">§ 10 Defined Extensions</a> defines an additional set of extensions and their identifiers.
 See the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list of registered WebAuthn Extension Identifiers.</p>
    <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><span class="secno">9.2. </span><span class="content">Defining Extensions</span><a class="self-link" href="#sctn-extension-specification"></a></h3>
-   <p>A definition of an extension MUST specify an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a>, a <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a> argument
-to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call,
+   <p>A definition of an extension MUST specify an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a>, a <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑧">client extension input</a> argument
+to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> call,
 the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing①⓪">client extension processing</a> rules, and a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①②">client extension output</a> value.
 If the extension communicates with the authenticator (meaning it is an <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑧">authenticator extension</a>),
 it MUST also specify the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①④">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑨">authenticator extension input</a> argument
 sent via the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑦">authenticatorGetAssertion</a> or <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑦">authenticatorMakeCredential</a> call,
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
-   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> know that the extension was honored by the authenticator. If an
+   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
    <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-parameters"><span class="secno">9.3. </span><span class="content">Extending Request Parameters</span><a class="self-link" href="#sctn-extension-request-parameters"></a></h3>
    <p>An extension defines one or two request arguments. The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-input">client extension input</dfn>,
-which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> to the client
-in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> call,
+which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑥">WebAuthn Relying Party</a> to the client
+in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
-The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> call.
+The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
 <pre class="example highlight" id="example-5335c503"><a class="self-link" href="#example-5335c503"></a><c- a>var</c-> assertionPromise <c- o>=</c-> navigator<c- p>.</c->credentials<c- p>.</c->get<c- p>({</c->
@@ -6788,36 +7347,36 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
     <c- p>}</c->
 <c- p>});</c->
 </pre>
-   <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a>.</p>
+   <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a>. Clients SHOULD ignore extensions with
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
-authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension
+authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension
 input</a>,
 and MUST define extensions for the <a data-link-type="dfn" href="#cddl" id="ref-for-cddl②">CDDL</a> types <code><a href="#iface-authentication-extensions-authenticator-inputs">AuthenticationExtensionsAuthenticatorInputs</a></code> and <code><a href="#iface-authentication-extensions-authenticator-outputs">AuthenticationExtensionsAuthenticatorOutputs</a></code> by defining an additional choice for the <code>$$extensionInput</code> and <code>$$extensionOutput</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9">group sockets</a> using the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑤">extension identifier</a> as the entry key.
-Extensions that do not require input parameters, and are thus defined as taking a Boolean <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑥">client extension input</a> value set to <code>true</code>,
+Extensions that do not require input parameters, and are thus defined as taking a Boolean <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a> value set to <code>true</code>,
 SHOULD define the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①②">authenticator extension input</a> also as the constant Boolean value <code>true</code> (CBOR major type
 7, value 21).</p>
    <p>The following example defines that an extension with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑥">identifier</a> <code>webauthnExample_foobar</code> takes an unsigned integer as <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①③">authenticator extension input</a>,
 and returns an array of at least one byte string as <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①③">authenticator extension output</a>:</p>
-<pre class="example" id="example-c42718c0"><a class="self-link" href="#example-c42718c0"></a>$$extensionInput //= (
-  webauthnExample_foobar: uint
-)
-$$extensionOutput //= (
-  webauthnExample_foobar: [+ bytes]
-)
+<pre class="example highlight" id="example-c42718c0"><a class="self-link" href="#example-c42718c0"></a><c- nc>$$extensionInput</c-> <c- o>//=</c-> <c- p>(</c->
+  <c- s>webauthnExample_foobar</c-><c- p>:</c-> uint
+<c- p>)</c->
+<c- nc>$$extensionOutput</c-> <c- o>//=</c-> <c- p>(</c->
+  <c- s>webauthnExample_foobar</c-><c- p>:</c-> <c- p>[</c-><c- o>+</c-> bytes<c- p>]</c->
+<c- p>)</c->
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> Extensions should aim to define authenticator arguments that are as small as possible. Some authenticators communicate
     over low-bandwidth links such as Bluetooth Low-Energy or NFC.</p>
    <h3 class="heading settled" data-level="9.4" id="sctn-client-extension-processing"><span class="secno">9.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-processing">Client Extension Processing</dfn></span><a class="self-link" href="#sctn-client-extension-processing"></a></h3>
-   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> during the creation of credentials or the
-generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> for the extension is used as an input to this client processing.
-For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a> as the value.</p>
+   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> during the creation of credentials or the
+generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension input</a> for the extension is used as an input to this client processing.
+For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑥">client extension input</a> as the value.</p>
    <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults④">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑧">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
-Like the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑨">client extension input</a>, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑥">client extension output</a> is a value that can be encoded in JSON.
+Like the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a>, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑥">client extension output</a> is a value that can be encoded in JSON.
 There MUST NOT be any values returned for ignored extensions.</p>
    <p>Extensions that require authenticator processing MUST define
-the process by which the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②⓪">client extension input</a> can be used to determine the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑦">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①④">authenticator extension input</a> and
+the process by which the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a> can be used to determine the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑦">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①④">authenticator extension input</a> and
 the process by which the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑧">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①④">authenticator extension output</a>, and the <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs③">unsigned extension output</a> if used, can be
 used to determine the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑦">client extension output</a>.</p>
    <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-processing"><span class="secno">9.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-processing">Authenticator Extension Processing</dfn></span><a class="self-link" href="#sctn-authenticator-extension-processing"></a></h3>
@@ -6827,7 +7386,7 @@ <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-pr
 as a separate map, keyed with the same <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②①">extension identifier</a>. This map only contains entries for authenticator
 extensions that make use of unsigned outputs. Unsigned outputs are useful when extensions output a signature over
 the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a> (because otherwise a signature would have to sign over itself, which isn’t possible) or when
-some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a>.</p>
+some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs④">unsigned extension outputs</a> are returned as a CBOR map in a top-level field named <code>unsignedExtensionOutputs</code> from both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑨">authenticatorGetAssertion</a>.</p>
    <p>For each supported extension, the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing④">authenticator extension processing</a> rule for that extension is used create the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a>, and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑤">unsigned extension output</a> if used, from the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑦">authenticator extension input</a> and possibly also other inputs.
 There MUST NOT be any values returned for ignored extensions.</p>
@@ -6838,39 +7397,39 @@ <h2 class="heading settled" data-level="10" id="sctn-defined-extensions"><span c
    <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions"><span class="secno">10.1. </span><span class="content">Client Extensions</span><a class="self-link" href="#sctn-defined-client-extensions"></a></h3>
    <p>This section defines extensions that are only <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑦">client extensions</a>.</p>
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
-   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> that have previously registered a
+   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
-order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
+order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
-     <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> option
- of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> method:</p>
+     <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> option
+ of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">get()</a></code> method:</p>
      <ul>
       <li data-md>
-       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
+       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑥">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑥">public-key</a></code>.</p>
       <li data-md>
-       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①①">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①②">id</a></code>.</p>
+       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①①">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①②">id</a></code>.</p>
      </ul>
-     <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> MAY contain a mixture
- of both WebAuthn <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑦">credential IDs</a> and U2F key handles;
+     <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> MAY contain a mixture
+ of both WebAuthn <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential IDs</a> and U2F key handles;
  stating the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid①">appid</a></code> via this extension
  does not prevent the user from using a WebAuthn-registered credential
- scoped to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④②">RP ID</a> stated in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤">rpId</a></code>.</p>
+ scoped to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a> stated in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑥">rpId</a></code>.</p>
     <li data-md>
-     <p>When <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, expect that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash④">rpIdHash</a></code> MAY be the hash of the <var>AppID</var> instead of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a>.</p>
+     <p>When <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, expect that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash④">rpIdHash</a></code> MAY be the hash of the <var>AppID</var> instead of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑨">RP ID</a>.</p>
    </ol>
    <p>This extension does not allow FIDO-compatible credentials to be created. Thus,
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
-but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
+but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> might be "example.com".</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6880,22 +7439,22 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
      <p><a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑧">Authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>A single USVString specifying a FIDO <var>AppID</var>.</p>
+     <p>A single DOMString specifying a FIDO <var>AppID</var>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑥"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
     <dd data-md>
      <ol>
       <li data-md>
-       <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> to the
+       <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑧">origin</a> to the
 FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application" id="ref-for-determining-the-facetid-of-a-calling-application①">determining the FacetID of a calling application</a>.</p>
       <li data-md>
        <p>Let <var>appId</var> be the extension input.</p>
       <li data-md>
        <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">determining if a
-caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code>.</p>
+caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③③">DOMException</a></code>.</p>
       <li data-md>
        <p>When <a href="#allowCredentialDescriptorListCreation">building allowCredentialDescriptorList</a>,
 if a U2F authenticator indicates that a credential is inapplicable (i.e. by
@@ -6906,7 +7465,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
        <p>Let <var>output</var> be the Boolean value <code>false</code>.</p>
       <li data-md>
        <p>When <a href="#assertionCreationDataCreation">creating assertionCreationData</a>,
-if the <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertion</a> was created by a U2F authenticator with the U2F application parameter set to the SHA-256 hash of <var>appId</var> instead of the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑥">RP ID</a>, set <var>output</var> to <code>true</code>.</p>
+if the <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertion</a> was created by a U2F authenticator with the U2F application parameter set to the SHA-256 hash of <var>appId</var> instead of the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤②">RP ID</a>, set <var>output</var> to <code>true</code>.</p>
      </ol>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the
@@ -6915,7 +7474,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤③">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code></dfn>;
 };
@@ -6931,8 +7490,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
-   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②③">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑧">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6942,9 +7501,9 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑧">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>A single USVString specifying a FIDO <var>AppID</var>.</p>
+     <p>A single DOMString specifying a FIDO <var>AppID</var>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑦"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑧"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="DOMString" id="dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
@@ -6955,14 +7514,14 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just after <a href="#CreateCred-DetermineRpId">establishing the RP ID</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑧">origin</a> to the FIDO algorithm
+         <p>Let <var>facetId</var> be the result of passing the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑨">origin</a> to the FIDO algorithm
 for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application" id="ref-for-determining-the-facetid-of-a-calling-application②">determining the FacetID of a calling application</a>.</p>
         <li data-md>
          <p>Let <var>appId</var> be the value of the extension input <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appidexclude" id="ref-for-dom-authenticationextensionsclientinputs-appidexclude">appidExclude</a></code>.</p>
         <li data-md>
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
-return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
+return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③④">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
          <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site①">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
@@ -6971,7 +7530,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just prior to <a href="#CreateCred-InvokeAuthnrMakeCred">invoking authenticatorMakeCredential</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
+         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②②">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
          <ol>
           <li data-md>
            <p>Check whether <var>C</var> was created using U2F on <var>authenticator</var> by sending a <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> whose "five parts" are set to the following values:</p>
@@ -6990,14 +7549,14 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
              <p>The length of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①③">id</a></code></code> (in bytes)</p>
             <dt data-md><var>key handle</var>
             <dd data-md>
-             <p>The value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①④">id</a></code></code>, i.e., the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential id</a>.</p>
+             <p>The value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①④">id</a></code></code>, i.e., the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential id</a>.</p>
            </dl>
           <li data-md>
            <p>If <var>authenticator</var> responds with <code>message:error:test-of-user-presence-required</code> (i.e., success):
 cease normal processing of this <var>authenticator</var> and indicate in a platform-specific manner
 that the authenticator is inapplicable. For example, this could be in the form of UI, or
-could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">user consent</a> from <var>authenticator</var> and, upon receipt, treating
-it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑤">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
+could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> from <var>authenticator</var> and, upon receipt, treating
+it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑥">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
 above except for setting <var>control byte</var> to <code>0x03</code> ("enforce-user-presence-and-sign"),
 and ignoring the response.</p>
          </ol>
@@ -7007,7 +7566,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
 };
@@ -7023,39 +7582,30 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑨">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremony</a>.</p>
+   <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>credProps</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
     <dd data-md>
-     <ol>
-      <li data-md>
-       <p>If processed during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>:</p>
-       <ol>
-        <li data-md>
-         <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
-       </ol>
-      <li data-md>
-       <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname①">authenticatorDisplayName</a></code> as described in its definition, using some client-specific procedure.
-If no suitable value is found, let <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname②">authenticatorDisplayName</a></code> be undefined.</p>
-     </ol>
+     <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
     <dt data-md>Client extension output
     <dd data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑥">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> operation.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②"><c- g>rk</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname③"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -7066,30 +7616,12 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①">boolean</a></span>
        <dd data-md>
-        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn>,
-is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
+        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn> or as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn>,
+is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③①">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a></span>
-       <dd data-md>
-        <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
-chosen by the user.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> MUST allow the user to choose this value.
-That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication</a> ceremony or MAY be made available outside
-the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> MAY reuse the same value
-for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a>.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>, by some unspecified mechanism, for this
-value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> MAY allow the user to configure the response to such a
-query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> vendor MAY provide a default response to such a query.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> MAY consider a user-configured response chosen by the user,
-and SHOULD allow the user to modify a vendor-provided default response.</p>
-        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output,
-if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a>.</p>
-        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑤">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②①">credential record</a>.</p>
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -7103,18 +7635,18 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
-   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
-   <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> is identical.</p>
+   <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>prf</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfvalues"><code><c- g>AuthenticationExtensionsPRFValues</c-></code></dfn> {
@@ -7124,7 +7656,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></dfn> {
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record①"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record①"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑨"><c- b>DOMString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<DOMString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑨"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7135,17 +7667,17 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-eval"><code>eval</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues②">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
-        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑦">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
+        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧⓪">DOMString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
        <dd data-md>
-        <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> is not empty.</p>
+        <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②④">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is not empty.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①③">registration</a>)
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
       <li data-md>
        <p>Set <code>hmac-secret</code> to <code>true</code> in the authenticator extensions input.</p>
       <li data-md>
@@ -7161,20 +7693,20 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <li data-md>
        <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results">results</a></code> to the decrypted PRF result(s), if any.</p>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
       <li data-md>
-       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
+       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑤">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑥">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
       <li data-md>
        <p>Initialize the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-prf" id="ref-for-dom-authenticationextensionsclientoutputs-prf">prf</a></code> extension output to an empty dictionary.</p>
       <li data-md>
        <p>Let <var>ev</var> be null, and try to find any applicable PRF input(s):</p>
        <ol>
         <li data-md>
-         <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential④">evalByCredential</a></code> is present and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑦">contains</a> an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry①">entry</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key①">key</a> is the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑧">base64url encoding</a> of the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential ID</a> that will be returned, let <var>ev</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-value" id="ref-for-map-value">value</a> of that entry.</p>
+         <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential④">evalByCredential</a></code> is present and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑦">contains</a> an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry①">entry</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key①">key</a> is the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑦">base64url encoding</a> of the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">credential ID</a> that will be returned, let <var>ev</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-value" id="ref-for-map-value">value</a> of that entry.</p>
         <li data-md>
          <p>If <var>ev</var> is null and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑤">eval</a></code> is present, then let <var>ev</var> be the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑥">eval</a></code>.</p>
        </ol>
@@ -7186,14 +7718,14 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
         <li data-md>
          <p>If <code><var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second②">second</a></code></code> is present, let <code>salt2</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second③">second</a></code>)</code>.</p>
         <li data-md>
-         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
+         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
         <li data-md>
          <p>Decrypt the extension result and set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results①">results</a></code> to the PRF result(s), if any.</p>
        </ol>
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
@@ -7213,25 +7745,30 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-results"><code>results</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues⑤">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
         <p>The results of evaluating the PRF for the inputs given in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑦">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑤">evalByCredential</a></code>. Outputs may not be available during <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>; see comments in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑧">eval</a></code>.</p>
+        <p><strong class="advisement"> For some use cases, for example if PRF outputs are used to derive encryption keys to use only on the client side,
+it may be necessary to omit this <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results③">results</a></code> output
+if the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③②">PublicKeyCredential</a></code> is sent to a remote server,
+for example to perform the procedures in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a>.
+Note in particular that the <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson①">RegistrationResponseJSON</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson①">AuthenticationResponseJSON</a></code> returned by <code><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③③">PublicKeyCredential</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson①">toJSON()</a></code></code> will include this <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results④">results</a></code> output if present.</strong></p>
       </dl>
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs">large, per-credential blobs</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
-and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤">required</a></code>.
-However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>,
+and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑧">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑥">required</a></code>.
+However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②⓪">discoverable credentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>largeBlob</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①⓪"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7244,22 +7781,22 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧①"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
     <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①④"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧②">DOMString</a></span>
        <dd data-md>
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -7269,7 +7806,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read①">read</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write①">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support①">support</a></code> is present and has the value <code class="idl"><a data-link-type="idl" href="#dom-largeblobsupport-required" id="ref-for-dom-largeblobsupport-required">required</a></code>:</p>
@@ -7277,11 +7814,11 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported">supported</a></code> to <code>true</code>.</p>
          <p class="note" role="note"><span class="marker">Note:</span> This is in anticipation of an authenticator capable of storing large blobs becoming available.
-   It occurs during extension processing in <a href="#CreateCred-process-extensions">step 12</a> of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①⓪">[[Create]]()</a></code>.
+   It occurs during extension processing in <a href="#CreateCred-process-extensions">step 12</a> of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①⓪">[[Create]](origin, options, sameOriginWithAncestors)</a></code>.
    The <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionslargebloboutputs" id="ref-for-dictdef-authenticationextensionslargebloboutputs">AuthenticationExtensionsLargeBlobOutputs</a></code> will be abandoned if no satisfactory authenticator becomes available.</p>
         <li data-md>
-         <p>If a <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator">candidate authenticator</a> becomes available (<a href="#CreateCred-async-loop">step 21</a> of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①①">[[Create]]()</a></code>) then,
-  before evaluating any <code><var>options</var></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑨">continue</a> (i.e. ignore the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator①">candidate authenticator</a>)
+         <p>If a <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator">candidate authenticator</a> becomes available (<a href="#CreateCred-async-loop">step 22</a> of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>) then,
+  before evaluating any <code><var>options</var></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue②③">continue</a> (i.e. ignore the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator①">candidate authenticator</a>)
   if the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator②">candidate authenticator</a> is not capable of storing large blobs.</p>
        </ol>
       <li data-md>
@@ -7291,20 +7828,20 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
          <p>If an <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator">authenticator is selected</a> and the <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator①">selected authenticator</a> supports large blobs, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported①">supported</a></code> to <code>true</code>, and <code>false</code> otherwise.</p>
        </ol>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support③">support</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑨">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑨">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If both <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read②">read</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write②">write</a></code> are present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⓪">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④⓪">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read③">read</a></code> is present and has the value <code>true</code>:</p>
@@ -7312,7 +7849,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <li data-md>
          <p>Initialize the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑧">client extension output</a>, <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-largeblob" id="ref-for-dom-authenticationextensionsclientoutputs-largeblob">largeBlob</a></code>.</p>
         <li data-md>
-         <p>If any authenticator indicates success (in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①③">[[DiscoverFromExternalSource]]()</a></code>), attempt to read any largeBlob data associated with the asserted credential.</p>
+         <p>If any authenticator indicates success (in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>), attempt to read any largeBlob data associated with the asserted credential.</p>
         <li data-md>
          <p>If successful, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob">blob</a></code> to the result.</p>
          <p class="note" role="note"><span class="marker">Note:</span> if the read is not successful, <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-largeblob" id="ref-for-dom-authenticationextensionsclientoutputs-largeblob①">largeBlob</a></code> will be present in <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑨">AuthenticationExtensionsClientOutputs</a></code> but the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob①">blob</a></code> member will not be present.</p>
@@ -7321,13 +7858,13 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write③">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> does not contain exactly one element:</p>
+         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> does not contain exactly one element:</p>
          <ol>
           <li data-md>
-           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
+           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑨">NotSupportedError</a></code>”.</p>
          </ol>
         <li data-md>
-         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticator</a>, associated with the indicated credential.</p>
+         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticator</a>, associated with the indicated credential.</p>
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written">written</a></code> to <code>true</code> if successful and <code>false</code> otherwise.</p>
        </ol>
@@ -7354,550 +7891,16 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid⑤">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticator</a>, associated with the specified credential.</p>
+        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a>, associated with the specified credential.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
-   <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span class="secno">10.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-verification-method">User Verification Method</dfn> Extension (uvm)</span><a class="self-link" href="#sctn-uvm-extension"></a></h4>
-   <p>This extension enables use of a user verification method.</p>
-   <dl>
-    <dt data-md>Extension identifier
-    <dd data-md>
-     <p><code>uvm</code></p>
-    <dt data-md>Operation applicability
-    <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">Authentication</a></p>
-    <dt data-md>Client extension input
-    <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②⓪"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code></dfn>;
-};
-</pre>
-    <dt data-md>Client extension processing
-    <dd data-md>
-     <p>None, except creating the authenticator extension input from the client extension input.</p>
-    <dt data-md>Client extension output
-    <dd data-md>
-     <p>Returns a JSON array of 3-element arrays of numbers that encodes the factors in the authenticator extension output.</p>
-<pre class="idl highlight def"><c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑥"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑥"><c- b>unsigned</c-> <c- b>long</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></dfn>;
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑦"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry" id="ref-for-typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></dfn>;
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs①①"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a data-link-type="idl-name" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="UvmEntries" id="dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code></dfn>;
-};
-</pre>
-    <dt data-md>Authenticator extension input
-    <dd data-md>
-     <p>The Boolean value <code>true</code>, encoded in CBOR (major type 7, value 21).</p>
-<pre>$$extensionInput //= (
-  uvm: true,
-)
-</pre>
-    <dt data-md>Authenticator extension processing
-    <dd data-md>
-     <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a> sets the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑥">authenticator extension output</a> to be one or more user verification methods indicating the method(s) used
-by the user to authorize the operation, as defined below. This extension can be added to attestation objects and assertions.</p>
-    <dt data-md>Authenticator extension output
-    <dd data-md>
-     <p>Authenticators can report up to 3 different user verification methods (factors) used in a single authentication instance,
-using the CBOR syntax defined below:</p>
-<pre>$$extensionOutput //= (
-  uvm: [ 1*3 uvmEntry ],
-)
-
-uvmEntry = [
-               userVerificationMethod: uint .size 4,
-               keyProtectionType: uint .size 2,
-               matcherProtectionType: uint .size 2
-           ]
-</pre>
-     <p>The semantics of the fields in each <code>uvmEntry</code> are as follows:</p>
-     <dl>
-      <dt data-md>userVerificationMethod
-      <dd data-md>
-       <p>The authentication method/factor used by the authenticator to verify the user. Available values are defined in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods" id="ref-for-user-verification-methods">Section 3.1 User Verification Methods</a> of <a data-link-type="biblio" href="#biblio-fido-registry" title="FIDO Registry of Predefined Values">[FIDO-Registry]</a>.</p>
-      <dt data-md>keyProtectionType
-      <dd data-md>
-       <p>The method used by the authenticator to protect the FIDO registration private key material. Available values are defined
-in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types" id="ref-for-key-protection-types">Section 3.2 Key Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry" title="FIDO Registry of Predefined Values">[FIDO-Registry]</a>.</p>
-      <dt data-md>matcherProtectionType
-      <dd data-md>
-       <p>The method used by the authenticator to protect the matcher that performs user verification. Available values are defined
-in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types" id="ref-for-matcher-protection-types">Section 3.3 Matcher Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry" title="FIDO Registry of Predefined Values">[FIDO-Registry]</a>.</p>
-     </dl>
-     <p>If >3 factors can be used in an authentication instance the authenticator vendor MUST select the 3 factors it believes
-will be most relevant to the Server to include in the UVM.</p>
-     <p>Example for <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> containing one UVM extension for a multi-factor authentication instance where 2 factors
-were used:</p>
-<pre>...                    -- RP ID hash (32 bytes)
-81                     -- UP and ED set
-00 00 00 01            -- (initial) signature counter
-...                    -- all public key alg etc.
-A1                     -- extension: CBOR map of one element
-    63                 -- Key 1: CBOR text string of 3 bytes
-        75 76 6d       -- "uvm" [=UTF-8 encoded=] string
-    82                 -- Value 1: CBOR array of length 2 indicating two factor usage
-        83              -- Item 1: CBOR array of length 3
-            02           -- Subitem 1: CBOR integer for User Verification Method Fingerprint
-            04           -- Subitem 2: CBOR short for Key Protection Type TEE
-            02           -- Subitem 3: CBOR short for Matcher Protection Type TEE
-        83              -- Item 2: CBOR array of length 3
-            04           -- Subitem 1: CBOR integer for User Verification Method Passcode
-            01           -- Subitem 2: CBOR short for Key Protection Type Software
-            01           -- Subitem 3: CBOR short for Matcher Protection Type Software
-</pre>
-   </dl>
-   <h4 class="heading settled" data-level="10.2.2" id="sctn-supplemental-public-keys-extension"><span class="secno">10.2.2. </span><span class="content">Supplemental public keys extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplementalpubkeys">supplementalPubKeys</dfn>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> is incapable of generating a supplemental key pair, or the registration or authentication operation fails for any reason, that key pair is omitted from the output. If no supplemental key pairs remain then this extension is ignored. In this case, there is no <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys④">supplementalPubKeys</a> extension output generated.</p>
-   <p>Supplemental keys are not <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credentials</a> and they do not have their own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential IDs</a>. Instead, any returned keys are a contextual attribute of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is used—along with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑤">supplementalPubKeys</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, a particular set of supplemental keys are returned by the extension, along with signatures demonstrating proof-of-possession of those keys.</p>
-   <p>Supplemental keys never have a scope that is larger than the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑧">user credential</a>. That is, they are never shared between any two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credentials</a> and can never be used to link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⓪">user credentials</a> together. They only communicate continuity of some property of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①①">user credential</a>.</p>
-   <h5 class="heading settled" data-level="10.2.2.1" id="sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a> including further signatures by “SPK1”.</p>
-   <p>The credential may move beyond the scope of that supplemental key (for example, by being exported and imported elsewhere, if <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a>) and, if used in this new domain, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> operation will return a <i>new</i> supplemental key, SPK2, and its signature. Subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> operations may observe either SPK1 or SPK2, depending on the context in which the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a> is being used.</p>
-   <p>A usage example is thus:</p>
-   <blockquote>
-    <p>A sign-in request is received by a website that, by regulation, must require certain authentication standards. The sign-in is done with a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a>, but also includes a supplemental key with an attestation that states that the supplemental key is only synced after a user has met or exceeded those standards. Since that supplemental key has been seen before, and was initially verified to meet the site’s authentication standards, additional sign-in challenges are not required.</p>
-   </blockquote>
-   <p>Another example of supplemental keys:</p>
-   <blockquote>
-    <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a> on its own. But if a signature from a supplemental key that is device-bound, and that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
-   </blockquote>
-   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Parties</a> give to the presence of a signature from a supplemental key may be based on information learned from its optional attestation. An attestation can indicate the level of protection enjoyed by a hardware-bound key, or the policies for other types of supplemental key.</p>
-   <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-keys-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-definition"></a></h5>
-   <dl>
-    <dt data-md>Extension identifier
-    <dd data-md>
-     <p><code>supplementalPubKeys</code></p>
-    <dt data-md>Operation applicability
-    <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②③">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication</a></p>
-    <dt data-md>Client extension input
-    <dd data-md>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionssupplementalpubkeysinputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysInputs</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑧"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑨"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⓪"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑨"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦①"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
-};
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①②"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysinputs" id="ref-for-dictdef-authenticationextensionssupplementalpubkeysinputs"><c- n>AuthenticationExtensionsSupplementalPubKeysInputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsSupplementalPubKeysInputs" id="dom-authenticationextensionsclientinputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></dfn>;
-};
-</pre>
-     <div>
-      <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-scopes"><code>scopes</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②">DOMString</a>></span>
-       <dd data-md>
-        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦③">DOMString</a>, defaulting to <code>"indirect"</code></span>
-       <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
-        <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect②">indirect</a></code>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④">DOMString</a>>, defaulting to <code>[]</code></span>
-       <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a>.
-Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
-Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
-        <p>The default value is the empty list, which indicates no preference.</p>
-      </dl>
-     </div>
-    <dt data-md>Client extension processing
-    <dd data-md>
-     <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientinputs-supplementalpubkeys">supplementalPubKeys</a></code> is present, the client creates the authenticator extension input from the client extension input.</p>
-    <dt data-md>Client extension output
-    <dd data-md>
-     <p>A sequence of <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑨">ArrayBuffer</a></code>s containing the signatures returned as the <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑥">unsigned extension output</a>.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionssupplementalpubkeysoutputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②⓪"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③⓪"><c- b>ArrayBuffer</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysOutputs" data-dfn-type="dict-member" data-export data-type="sequence<ArrayBuffer>" id="dom-authenticationextensionssupplementalpubkeysoutputs-signatures"><code><c- g>signatures</c-></code></dfn>;
-};
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs①②"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysoutputs" id="ref-for-dictdef-authenticationextensionssupplementalpubkeysoutputs"><c- n>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsSupplementalPubKeysOutputs" id="dom-authenticationextensionsclientoutputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></dfn>;
-};
-</pre>
-    <dt data-md>Authenticator extension input
-    <dd data-md>
-     <p>A CBOR expression of the client extension input</p>
-<pre>supplementalPublicKeyInputs = {
-  scopes: [+
-    ; A key that has a broader scope than a single device, but still more
-    ; limited than a multi-device credential. The precise scope is specified
-    ; by the attestation of this supplemental public key.
-    "provider" /
-
-    ; A key with "device" scope MUST NOT leave the device on which it is
-    ; created.
-    "device"],
-  attestation: tstr,
-  attestationFormats: [* tstr],
-}
-$$extensionInput //= (
-  supplementalPubKeys: supplementalPublicKeyInputs,
-)
-</pre>
-    <dt data-md>Authenticator extension output
-    <dd data-md>
-     <p>The supplemental public key attestation objects, defined by the <code>attObjForSupplementalPubKey</code> type:</p>
-<pre>$$extensionOutput //= (
-    ; This array of supplemental public keys MUST be ordered
-    ; lexicographically by scope and MUST NOT include more than one element
-    ; with a given scope.
-
-    supplementalPubKeys: [+ attObjForSupplementalPubKey],
-)
-
-; This object conveys an attested supplemental public key and is analogous
-; to \`attObj\`.
-attObjForSupplementalPubKey = {
-    aaguid:  bstr,  ; AAGUID (16 bytes fixed-length)
-                    ; https://www.w3.org/TR/webauthn/#aaguid
-
-    spk:     bstr,  ; The public key (self-describing variable length,
-                    ; COSE_Key format, CBOR-encoded)).
-
-    ; See the definition of `scopes` in `supplementalPublicKeyInputs`.
-
-    scope: "provider" / "device",
-
-    ; An authenticator-generated random nonce for inclusion in the attestation
-    ; signature. If the authenticator chooses to not generate a nonce, it sets this
-    ; to a zero-length byte string. See the note below about "randomNonce" for a
-    ; discussion on the nonce's purpose.
-
-    nonce: bstr .size (0..32),
-
-    ; See https://www.w3.org/TR/webauthn/#sctn-generating-an-attestation-object
-    ;
-    ; Attestation statement formats define the \`fmt\` and \`attStmt\` members of
-    ; $$attStmtType.
-    ; Note that \`fmt\` and \`attStmt\` are top-level members of
-    ; \`attObjForSupplementalPubKey\`.
-    ;
-    ; In summary, the \`attStmt\` will (typically) contain:
-    ;   (1) a SIGNATURE value calculated (using the attestation private key)
-    ;       over (prefix || aaguid || spk || nonce) where \`prefix\` is
-    ;       h'737570706c656d656e74616c5075624b657973206174746573746174696f6e2e
-    ;         00ffffffff'.
-    ;       (See the attestation calculations section, below, for a discussion
-    ;       about the purpose of this \`prefix\` value.)
-    ;   (2) the attestation certificate or public key, and supporting certificates,
-    ;       if any.
-    ;
-    ; Note that there are details dependent upon the particular attestation
-    ; statement format.
-    ; See https://www.w3.org/TR/webauthn/#sctn-defined-attestation-formats.
-
-    $$attStmtType,
-
-    ; An optional boolean that indicates whether the attestation statement
-    ; contains uniquely identifying information. This can only be true
-    ; when the \`attestation\` field of the extension input is "enterprise"
-    ; and either the user-agent or the authenticator permits uniquely
-    ; identifying attestation for the requested RP ID.
-
-    ? epAtt: bool .default false,
-}
-
-</pre>
-    <dt data-md>Unsigned extension output
-    <dd data-md>
-     <p>A non-empty CBOR array of byte strings containing the signatures generated with the supplemental private keys, in the same order as in the authenticator extension output.</p>
-<pre>supplementalPublicKeyOutputs = [+ bstr]
-
-$$unsignedExtensionOutputs //= (
-  supplementalPubKeys: supplementalPublicKeyOutputs,
-)
-</pre>
-    <dt data-md>Authenticator extension processing
-    <dd data-md>
-     <p>For both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operations:</p>
-     <ol>
-      <li data-md>
-       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
-      <li data-md>
-       <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
-      <li data-md>
-       <p>Let <var>spks</var> and <var>spkSigs</var> be empty arrays.</p>
-      <li data-md>
-       <p>Sort <var>scopes</var> lexicographically.</p>
-      <li data-md>
-       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <var>scope</var> in <var>scopes</var>:</p>
-       <ol>
-        <li data-md>
-         <p>If a supplemental key with scope <var>scope</var> does not already exist for this {<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">RP ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">userHandle</a>} tuple on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, create it using the same public key algorithm as that used by the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑤">user credential</a>'s <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pair</a>, otherwise locate the existing supplemental key.</p>
-        <li data-md>
-         <p>Let <var>attFormat</var> be the chosen <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑧">attestation statement format</a>, and <var>attAaguid</var> be a 16-byte value, based on the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation①">attestation</a></code> in the extension input:</p>
-         <dl class="switch">
-          <dt data-md>none
-          <dd data-md>
-           <p><var>attFormat</var> is "none" or "self", at the authenticator’s discretion, and <var>attAaguid</var> is 16 zero bytes. (Note that, since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key">supplemental public key</a> is already exercised during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> calls, the proof-of-possession property provided by "self" attestation is superfluous in that context.)</p>
-          <dt data-md>indirect, direct
-          <dd data-md>
-           <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑨">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator’s</a> AAGUID. (Since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①">supplemental public key</a>'s scope is different from the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑥">user credential</a>, it will often have a different attestation. For example, the attestation for a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key②">supplemental public key</a> with “device” scope can be tied to hardware roots of trust, although it does not have to be.)</p>
-          <dt data-md>enterprise
-          <dd data-md>
-           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⓪">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator’s</a> AAGUID.</p>
-           <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticators</a>.</p>
-         </dl>
-        <li data-md>
-         <p>Let <var>spk</var> be the newly created or existing supplemental public key, in COSE_Key format <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑨">in the same fashion as for the user credential’s credentialPublicKey</a> when the latter is conveyed in <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①③">attested credential data</a>.</p>
-        <li data-md>
-         <p>Let <var>supplementalPrivateKey</var> be the newly created or existing private key corresponding to <var>spk</var>.</p>
-        <li data-md>
-         <p>Let <var>randomNonce</var> be a fresh randomly-generated byte string of 32 bytes maximum length, or a zero length byte string if the authenticator chooses to not generate a nonce.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> <var>randomNonce</var>’s purpose is to randomize the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑤">attestation signature</a> value for <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key③">supplemental public keys</a>. If this is not done, then an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑥">attestation signature</a> value remains constant for all such signatures issued on behalf of this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑦">user credential</a>, possibly exposing the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a>'s <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">attestation private key</a> to side-channel attacks. The randomness-generation mechanism should be carefully chosen by the authenticator implementer.</p>
-        <li data-md>
-         <p>Let <var>supplementalPubKey</var> be a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②①">CBOR</a> map as defined by <code>attObjForSupplementalPubKey</code> above, with keys and values as follows:</p>
-         <p class="note" role="note"><span class="marker">Note:</span> as with all CBOR structures used in this specification, the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form⑤">CTAP2 canonical CBOR encoding form</a> MUST be used.</p>
-         <ol>
-          <li data-md>
-           <p>Set a key and value for the <code>scope</code> group based on the value of <var>scope</var>.</p>
-          <li data-md>
-           <p>Let the <code>aaguid</code> key’s value be <var>attAaguid</var>.</p>
-          <li data-md>
-           <p>Let the <code>spk</code> key’s value be <var>spk</var>.</p>
-          <li data-md>
-           <p>Let the <code>nonce</code> key’s value be <var>randomNonce</var>.</p>
-          <li data-md>
-           <p>Let the values of the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9①">group socket</a> be the result of generating an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a> with the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②①">attestation statement format</a>, <var>attFormat</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>.</p>
-           <p class="note" role="note"><span class="marker">Note:</span> The details of the <code>$$attStmtType</code> values are dependent upon the particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> format. See <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>.</p>
-          <li data-md>
-           <p>If the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9②">group socket</a> contains uniquely identifying information then let <code>epAtt</code> be <code>true</code>. Otherwise omit the <code>epAtt</code> field. (This field can only be <code>true</code> when the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation②">attestation</a></code> field of the extension input is "enterprise" and either the user-agent or the authenticator permits uniquely identifying attestation for the requested RP ID.)</p>
-         </ol>
-        <li data-md>
-         <p>Append <var>supplementalPubKey</var> to <var>spks</var>.</p>
-        <li data-md>
-         <p>Let <var>spkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a> with <var>supplementalPrivateKey</var>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>spkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> knows that <var>spkSig</var> is a fresh signature.</p>
-        <li data-md>
-         <p>Append <var>spkSig</var> to <var>spkSigs</var>.</p>
-       </ol>
-      <li data-md>
-       <p>Let the <code>supplementalPubKeys</code> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑦">authenticator extension output</a> value be the CBOR array <var>spks</var>.</p>
-      <li data-md>
-       <p>Let the CBOR encoding of <var>spkSigs</var> be the extension’s <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑦">unsigned extension output</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> <var>spkSigs</var> cannot be included in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑧">authenticator extension output</a> because it is returned inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> and that would imply that the signature signs over itself.</p>
-     </ol>
-   </dl>
-   <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-supplemental-public-keys-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-aaguid"></a></h6>
-   <p>Any non-zero <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑤">AAGUID</a>s included in the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑥">supplementalPubKeys</a></code> extension output aid a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> in validating the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> of the supplemental public key. The interpretation of each AAGUID depends on the scope of the corresponding key. Some or all may differ from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①④">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑨">multi-device credential</a>. Thus the AAGUID of a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key④">supplemental public key</a> MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
-   <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-supplemental-public-keys-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-calculations"></a></h6>
-   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a supplemental public key, the typical value for <code>authData</code> contains the attestation signature itself, which is impossible. Also the attestation of a supplemental public key is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
-   <p>Therefore when calculating an attestation for a supplemental public key, the inputs are:</p>
-   <ul>
-    <li data-md>
-     <p>For <code>authData</code>, substitute the concatenation of the byte string h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e00ffffffff' and the value of <var>aaguid</var> from the extension output.</p>
-    <li data-md>
-     <p>For <code>hash</code>, substitute the concatenation of the <var>spk</var> and <var>nonce</var> fields from the extension output. (The nonce MAY be empty.)</p>
-   </ul>
-   <p>The attestation signature is thus typically calculated over the bytes of <code>(h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e00ffffffff' || <var>aaguid</var> || <var>spk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a supplemental public key can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑧">user credential</a>.</p>
-   <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>spkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the supplemental private key.</p>
-   <h5 class="heading settled" data-level="10.2.2.3" id="sctn-supplemental-public-keys-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>supplementalPubKeys</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification"></a></h5>
-   <p>Verifying the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑦">supplementalPubKeys</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> whenever a supplemental public key is returned within the extension output.</p>
-   <p>The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑧">supplementalPubKeys</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①③">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②②">credential records</a>:</p>
-   <dl>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</dfn>
-    <dd data-md>
-     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">public key credential source</a>.</p>
-     <p>A <dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-supplemental-public-key-record">supplemental public key record</dfn> is an abstract representation of a registered supplemental public key.
-It is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑥">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①④">items</a>:</p>
-     <dl>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-aaguid">aaguid</dfn>
-      <dd data-md>
-       <p>The <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑥">AAGUID</a> included with the supplemental public key.
-This MAY be different from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a> in the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject②">attestationObject</a>, if any, of the containing <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②③">credential record</a>.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-spk">spk</dfn>
-      <dd data-md>
-       <p>The public key portion of the supplemental public key.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-scope">scope</dfn>
-      <dd data-md>
-       <p>The scope of the supplemental public key. See <a href="#sctn-supplemental-public-keys-extension-definition">§ 10.2.2.2 Extension Definition</a> for details.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-fmt">fmt</dfn>
-      <dd data-md>
-       <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②②">attestation statement format</a> of the supplemental public key’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a>.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</dfn>
-      <dd data-md>
-       <p>The supplemental public key’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a>.</p>
-     </dl>
-   </dl>
-   <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">navigator.credentials.create()</a></code> call,
-then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 20</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
-   <ol>
-    <li data-md>
-     <p>Verify that the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys">supplementalPubKeys</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures" id="ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures">signatures</a></code> field. Let <var>signatures</var> be the value of that field.</p>
-    <li data-md>
-     <p>Let <var>attObjsForSupplementalPublicKey</var> be the value of the <code>supplementalPubKeys</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑨">authenticator extension output</a> from <var>authData</var>.</p>
-    <li data-md>
-     <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>attObjsForSupplementalPublicKey</var> is not equal to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size②">size</a> of <var>signatures</var> then abort the registration process with an error.</p>
-    <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">Iterate</a> over the indices of <var>attObjsForSupplementalPublicKey</var> (which, after the check in the previous step, must also be the indices of <var>signatures</var>). Then, for each (<var>attObjForSupplementalPubKey</var>, <var>signature</var>) from the two lists:</p>
-     <ol>
-      <li data-md>
-       <p>Extract the contained fields from <var>attObjForSupplementalPubKey</var>: <var>aaguid</var>, <var>spk</var>, <var>nonce</var>, <var>fmt</var> and <var>attStmt</var>. Also let <var>scope</var> reflect the scope, specified by the member of the <code>scope</code> group that is present.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForSupplementalPubKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of the top-level <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a>.</p>
-      <li data-md>
-       <p>Verify that <var>signature</var> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①③">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑤">supplemental public key</a> <var>spk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑨">user credential</a>.)</p>
-      <li data-md>
-       <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑦">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②③">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
-      <li data-md>
-       <p>Create a new <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record①">supplemental public key record</a> with the contents:</p>
-       <dl>
-        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid">aaguid</a>
-        <dd data-md>
-         <p>The value of <var>aaguid</var>.</p>
-        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk">spk</a>
-        <dd data-md>
-         <p>The value of <var>spk</var>.</p>
-        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope">scope</a>
-        <dd data-md>
-         <p>The value of <var>scope</var>.</p>
-        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-fmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-fmt">fmt</a>
-        <dd data-md>
-         <p>The value of <var>fmt</var>.</p>
-        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</a>
-        <dd data-md>
-         <p>The value of <var>attStmt</var>.</p>
-       </dl>
-       <p>In <a href="#reg-ceremony-store-credential-record">step 27</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-add this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record②">supplemental public key record</a> to the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</a> member of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②④">credential record</a>.</p>
-     </ol>
-   </ol>
-   <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
-   <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④④">navigator.credentials.get()</a></code> call,
-then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
-   <ol>
-    <li data-md>
-     <p>Let <var>recognizedSpks</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>.</p>
-    <li data-md>
-     <p>Verify that the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys①">supplementalPubKeys</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures" id="ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures①">signatures</a></code> field. Let <var>signatures</var> be the value of that field.</p>
-    <li data-md>
-     <p>Let <var>attObjsForSupplementalPubKeys</var> be the value of the <code>supplementalPubKeys</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output②⓪">authenticator extension output</a> from <var>authData</var>.</p>
-    <li data-md>
-     <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size③">size</a> of <var>attObjsForSupplementalPubKeys</var> is not equal to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size④">size</a> of <var>signatures</var> then abort the authentication process with an error.</p>
-    <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②②">Iterate</a> over the indices of <var>attObjsForSupplementalPubKeys</var> (which, after the check in the previous step, must also be the indices of <var>signatures</var>). Then, for each (<var>attObjForSupplementalPubKey</var>, <var>signature</var>) from the two lists:</p>
-     <ol>
-      <li data-md>
-       <p>Extract the contained fields from <var>attObjForSupplementalPubKey</var>: <var>aaguid</var>, <var>spk</var>, <var>nonce</var>, <var>fmt</var>, <var>attStmt</var>. Also let <var>scope</var> reflect the scope, specified by the member of the <code>scope</code> group that is present.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForSupplementalPubKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a>.</p>
-      <li data-md>
-       <p>Verify that <var>signature</var> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①④">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑥">supplemental public key</a> <var>spk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②⓪">user credential</a>.)</p>
-      <li data-md>
-       <p>Let <var>matchedSpkRecords</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①⓪">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②③">For each</a> <var>spkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys①">supplementalPubKeys</a>:</p>
-       <ol>
-        <li data-md>
-         <p>If <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid①">aaguid</a> equals <var>aaguid</var>, <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk①">spk</a> equals <var>spk</var>,
-  and <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope①">scope</a> equals <var>scope</var>:</p>
-         <ol>
-          <li data-md>
-           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑥">Append</a> <var>spkRecord</var> to <var>matchedSpkRecords</var>.</p>
-         </ol>
-       </ol>
-      <li data-md>
-       <p>If <var>matchedSpkRecords</var></p>
-       <dl class="switch">
-        <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size⑤">size</a> greater than one:
-        <dd data-md>
-         <p>Some form of error has occurred: <var>credentialRecord</var> invariants have been broken. Terminate these verification steps.</p>
-        <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size⑥">size</a> equal to one:
-        <dd data-md>
-         <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑦">supplemental public key</a></p>
-         <p>If <var>fmt</var>’s value is "none" then there is no attestation signature to verify and this is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑧">supplemental public key</a> with a valid signature. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
-         <p>Otherwise, let <var>spkRecord</var> be <var>matchedSpkRecords</var>[0]. If the <var>attStmt</var> in <var>attObjForSupplementalPubKey</var>:</p>
-         <dl class="switch">
-          <dt data-md>equals <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt①">attStmt</a> by binary equality:
-          <dd data-md>
-           <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑨">supplemental public key</a> with a valid signature and valid attestation. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
-           <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
-          <dt data-md>does not equal <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt②">attStmt</a> by binary equality:
-          <dd data-md>
-           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②④">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-           <p>If the result is:</p>
-           <dl class="switch">
-            <dt data-md>successful
-            <dd data-md>
-             <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①⓪">supplemental public key</a> with a valid signature and valid attestation. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
-            <dt data-md>unsuccessful
-            <dd data-md>
-             <p>Some form of error has occurred. It is indeterminate whether this is a valid <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①①">supplemental public key</a>. Either terminate these verification steps with an error or continue to the next iteration, if any, to ignore this key.</p>
-           </dl>
-         </dl>
-        <dt data-md>is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑨">empty</a>:
-        <dd data-md>
-         <p>This is possibly a new <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①②">supplemental public key</a>.</p>
-         <ol>
-          <li data-md>
-           <p>Let <var>matchedSpkKeys</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①⓪">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①①">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②④">For each</a> <var>spkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys②">supplementalPubKeys</a>:</p>
-           <ol>
-            <li data-md>
-             <p>If <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk②">spk</a> equals <var>spk</var>:</p>
-             <ol>
-              <li data-md>
-               <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑦">Append</a> <var>spkRecord</var> to <var>matchedSpkKeys</var>.</p>
-             </ol>
-           </ol>
-          <li data-md>
-           <p>If <var>matchedSpkKeys</var> is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a>:</p>
-           <dl class="switch">
-            <dt data-md>If <var>fmt</var>’s value is "none":
-            <dd data-md>
-             <p>There is no attestation signature to verify and this is a new supplemental key. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a> and then continue to the next iteration, if any.</p>
-            <dt data-md>Otherwise:
-            <dd data-md>
-             <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑦">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-             <p>If the result is:</p>
-             <dl class="switch">
-              <dt data-md>successful
-              <dd data-md>
-               <p>This is a new <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①③">supplemental public key</a>. <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record①">Create a new supplemental public key record</a> then continue to the next iteration, if any.</p>
-              <dt data-md>unsuccessful
-              <dd data-md>
-               <p>Some form of error has occurred and a supplemental public key record cannot be created. Either terminate these verification steps with an error or continue to the next iteration, if any, to ignore this supplemental public key.</p>
-             </dl>
-           </dl>
-          <li data-md>
-           <p>Otherwise there is some form of error: we recieved a known <var>spk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> has stored along with that <var>spk</var> value. Terminate these verification steps.</p>
-         </ol>
-       </dl>
-     </ol>
-   </ol>
-   <p>At the end of these steps, <var>recognizedSpks</var> contains zero or more <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①④">supplemental public keys</a> that were previously known for this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②①">user credential</a>. These keys make claims about the continuity of certain factors between this authentication attempt and previous ones. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> should judge those claims in light of the attestations provided, if any, and evaluate the risk of this authentication in light of this information.</p>
-   <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a>.</p>
-   <p>To <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</dfn>, perform the following steps:</p>
-   <ol>
-    <li data-md>
-     <p>Create a new <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record③">supplemental public key record</a> with the contents:</p>
-     <dl>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid②">aaguid</a>
-      <dd data-md>
-       <p>The value of <var>aaguid</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk③">spk</a>
-      <dd data-md>
-       <p>The value of <var>spk</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope②">scope</a>
-      <dd data-md>
-       <p>The value of <var>scope</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-fmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-fmt①">fmt</a>
-      <dd data-md>
-       <p>The value of <var>fmt</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt③">attStmt</a>
-      <dd data-md>
-       <p>The value of <var>attStmt</var>.</p>
-     </dl>
-     <p>In <a href="#authn-ceremony-update-credential-record">step 23</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑧">append</a> this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record④">supplemental public key record</a> to <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys③">supplementalPubKeys</a>.</p>
-   </ol>
+   <p>This section is currently empty.</p>
    <h2 class="heading settled" data-level="11" id="sctn-automation"><span class="secno">11. </span><span class="content">User Agent Automation</span><a class="self-link" href="#sctn-automation"></a></h2>
    <p>For the purposes of user agent automation and <a data-link-type="dfn" href="#web-application" id="ref-for-web-application④">web application</a> testing, this document defines a number of <a data-link-type="biblio" href="#biblio-webdriver" title="WebDriver">[WebDriver]</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands">extension commands</a>.</p>
    <h3 class="heading settled" data-level="11.1" id="sctn-automation-webdriver-capability"><span class="secno">11.1. </span><span class="content">WebAuthn WebDriver Extension Capability</span><a class="self-link" href="#sctn-automation-webdriver-capability"></a></h3>
@@ -7934,7 +7937,7 @@ <h3 class="heading settled" data-level="11.1" id="sctn-automation-webdriver-capa
      <p>Otherwise, the match is successful.</p>
    </ol>
    <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension-capabilities"><span class="secno">11.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-capabilities">Authenticator Extension Capabilities</dfn></span><a class="self-link" href="#sctn-authenticator-extension-capabilities"></a></h4>
-   <p>Additionally, <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability①">extension capabilities</a> are defined for every <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①④">authenticator extension</a> (i.e. those defining <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing⑤">authenticator extension processing</a>) defined in this specification:</p>
+   <p>Additionally, <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability①">extension capabilities</a> are defined for every <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator extension</a> (i.e. those defining <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing⑤">authenticator extension processing</a>) defined in this specification:</p>
    <figure class="table" id="table-virtualAuthenticatorsExtensionsWebdriverCapability">
     <table class="data">
      <thead>
@@ -7944,26 +7947,21 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
        <th>Value Type
        <th>Description
      <tbody>
-      <tr>
-       <td>User Verification Method Extension Support
-       <td><code>"webauthn:extension:uvm"</code>
-       <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node②">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method">User Verification Method</a> extension.
       <tr>
        <td>Pseudo-Random Function Extension Support
        <td><code>"webauthn:extension:prf"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node③">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node②">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
       <tr>
        <td>Large Blob Storage Extension Support
        <td><code>"webauthn:extension:largeBlob"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node④">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob②">largeBlob</a> extension.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node③">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob②">largeBlob</a> extension.
       <tr>
        <td>credBlob Extension Support
        <td><code>"webauthn:extension:credBlob"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node④">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.
     </table>
    </figure>
    <p>When <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-validate-capabilities" id="ref-for-dfn-validate-capabilities①">validating capabilities</a>, the extension-specific substeps to validate an <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities">authenticator extension capability</a> <code>key</code> with <code>value</code> are the following:</p>
@@ -7976,12 +7974,12 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
    <p>When <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-matching-capabilities" id="ref-for-dfn-matching-capabilities①">matching capabilities</a>, the extension-specific steps to match an <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities①">authenticator extension capability</a> <code>key</code> with <code>value</code> are the following:</p>
    <ol>
     <li data-md>
-     <p>If <code>value</code> is <code>true</code> and the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑥">endpoint node</a> WebAuthn WebDriver implementation does not support the <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑤">authenticator extension</a> identified by the <code>key</code>,
+     <p>If <code>value</code> is <code>true</code> and the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation does not support the <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①④">authenticator extension</a> identified by the <code>key</code>,
 the match is unsuccessful.</p>
     <li data-md>
      <p>Otherwise, the match is successful.</p>
    </ol>
-   <p>User-Agents implementing defined <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑥">authenticator extensions</a> SHOULD implement the corresponding <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities②">authenticator extension capability</a>.</p>
+   <p>User-Agents implementing defined <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑤">authenticator extensions</a> SHOULD implement the corresponding <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities②">authenticator extension capability</a>.</p>
    <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authenticators"><span class="secno">11.2. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticators">Virtual Authenticators</dfn></span><a class="self-link" href="#sctn-automation-virtual-authenticators"></a></h3>
    <p>These WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands②">extension commands</a> create and interact with <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②">Virtual Authenticators</a>: software implementations of the <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model③">Authenticator Model</a>. <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③">Virtual Authenticators</a> are stored in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticator-database">Virtual Authenticator Database</dfn>.
 Each stored <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators④">virtual authenticator</a> has the following properties:</p>
@@ -8001,34 +7999,30 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p>If set to <code>true</code> the authenticator will support <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑥">client-side discoverable credentials</a>.</p>
     <dt data-md><var>hasUserVerification</var>
     <dd data-md>
-     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a>.</p>
+     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">user verification</a>.</p>
     <dt data-md><var>isUserConsenting</var>
     <dd data-md>
-     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
+     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
     <dt data-md><var>isUserVerified</var>
     <dd data-md>
-     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
+     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This property has no effect if <var>hasUserVerification</var> is set to <code>false</code>.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A string array containing the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②②">extension identifiers</a> supported by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑨">Virtual Authenticator</a>.</p>
-     <p>A <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⓪">Virtual authenticator</a> MUST support all <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑦">authenticator extensions</a> present in its <var>extensions</var> array.
-It MUST NOT support any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑧">authenticator extension</a> not present in its <var>extensions</var> array.</p>
-    <dt data-md><var>uvm</var>
-    <dd data-md>
-     <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries①">UvmEntries</a></code> array to be set as the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output②①">authenticator extension output</a> when processing the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method①">User Verification Method</a> extension.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> This property has no effect if the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">Virtual Authenticator</a> does not support the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method②">User Verification Method</a> extension.</p>
+     <p>A <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⓪">Virtual authenticator</a> MUST support all <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑥">authenticator extensions</a> present in its <var>extensions</var> array.
+It MUST NOT support any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑦">authenticator extension</a> not present in its <var>extensions</var> array.</p>
     <dt data-md><var>defaultBackupEligibility</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">Public Key Credential Source</a>.
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">virtual authenticator</a>.</p>
     <dt data-md><var>defaultBackupState</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②③">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①③">virtual authenticator</a>.</p>
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">Public Key Credential Source</a>.
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑤">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②③">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-authenticator"><span class="secno">11.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-virtual-authenticator">Add Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-add-virtual-authenticator"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①④">Virtual Authenticator</a>. It is
+   <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①③">Virtual Authenticator</a>. It is
 defined as follows:</p>
    <figure class="table" id="table-addVirtualAuthenticator">
     <table class="data">
@@ -8042,7 +8036,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
        <td><code>/session/{session id}/webauthn/authenticator</code>
     </table>
    </figure>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-configuration">Authenticator Configuration</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps">remote end steps</a> as <var>parameters</var>. It contains the following <var>key</var> and <var>value</var> pairs:</p>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-configuration">Authenticator Configuration</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps">remote end steps</a> as <var>parameters</var>. It contains the following <var>key</var> and <var>value</var> pairs:</p>
    <figure class="table" id="table-authenticatorConfiguration">
     <table class="data">
      <thead>
@@ -8087,11 +8081,6 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
        <td>string array
        <td>An array containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②③">extension identifiers</a>
        <td>Empty array
-      <tr>
-       <td><var>uvm</var>
-       <td><code class="idl"><a data-link-type="idl" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries②">UvmEntries</a></code>
-       <td>Up to 3 <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method③">User Verification Method</a> entries
-       <td>Empty array
       <tr>
        <td><var>defaultBackupEligibility</var>
        <td>boolean
@@ -8107,10 +8096,10 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps①">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object①">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②">invalid argument</a>.</p>
+     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object①">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②">invalid argument</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <var>parameters</var> is a <a data-link-type="dfn" href="#authenticator-configuration" id="ref-for-authenticator-configuration">Authenticator Configuration</a> object.</p>
     <li data-md>
-     <p>Let <var>authenticator</var> be a new <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑤">Virtual Authenticator</a>.</p>
+     <p>Let <var>authenticator</var> be a new <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①④">Virtual Authenticator</a>.</p>
     <li data-md>
      <p>For each enumerable <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-own-property" id="ref-for-sec-own-property">own property</a> in <var>parameters</var>:</p>
      <ol>
@@ -8141,7 +8130,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
      <p>For each <var>extension</var> in <var>authenticator</var>.<var>extensions</var>:</p>
      <ol>
       <li data-md>
-       <p>If <var>extension</var> is not an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②④">extension identifier</a> supported by the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑦">endpoint node</a> WebAuthn WebDriver implementation,
+       <p>If <var>extension</var> is not an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②④">extension identifier</a> supported by the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑥">endpoint node</a> WebAuthn WebDriver implementation,
 return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑥">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑥">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-unsupported-operation" id="ref-for-dfn-unsupported-operation">unsupported operation</a>.</p>
      </ol>
     <li data-md>
@@ -8154,7 +8143,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success">success</a> with data <var>authenticatorId</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual-authenticator"><span class="secno">11.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-virtual-authenticator">Remove Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-remove-virtual-authenticator"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-virtual-authenticator" id="ref-for-remove-virtual-authenticator">Remove Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands④">extension command</a> removes a previously created <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑥">Virtual Authenticator</a>.
+   <p>The <a data-link-type="dfn" href="#remove-virtual-authenticator" id="ref-for-remove-virtual-authenticator">Remove Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands④">extension command</a> removes a previously created <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑤">Virtual Authenticator</a>.
 It is defined as follows:</p>
    <figure class="table" id="table-removeVirtualAuthenticator">
     <table class="data">
@@ -8171,15 +8160,15 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps②">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database①">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database①">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑥">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑧">Virtual Authenticator</a> identified by <var>authenticatorId</var> from the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database②">Virtual Authenticator Database</a></p>
+     <p>Remove the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var> from the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database②">Virtual Authenticator Database</a></p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑧">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -8192,7 +8181,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <td><code>/session/{session id}/webauthn/authenticator/{authenticatorId}/credential</code>
     </table>
    </figure>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-parameters">Credential Parameters</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object②">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps③">remote end steps</a> as <var>parameters</var>. It contains the following <var>key</var> and <var>value</var> pairs:</p>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-parameters">Credential Parameters</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object②">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps③">remote end steps</a> as <var>parameters</var>. It contains the following <var>key</var> and <var>value</var> pairs:</p>
    <figure class="table" id="table-credentialParameters">
     <table class="data">
      <thead>
@@ -8203,7 +8192,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <tbody>
       <tr>
        <td><var>credentialId</var>
-       <td>The <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑥">Credential ID</a> encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑨">Base64url Encoding</a>.
+       <td>The <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑦">Credential ID</a> encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑧">Base64url Encoding</a>.
        <td>string
       <tr>
        <td><var>isResidentCredential</var>
@@ -8211,46 +8200,56 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <td>boolean
       <tr>
        <td><var>rpId</var>
-       <td>The <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑧">Relying Party ID</a> the credential is scoped to.
+       <td>The <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">Relying Party ID</a> the credential is scoped to.
        <td>string
       <tr>
        <td><var>privateKey</var>
-       <td> An asymmetric key package containing a single <a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey②">private key</a> per <a data-link-type="biblio" href="#biblio-rfc5958" title="Asymmetric Key Packages">[RFC5958]</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⓪">Base64url Encoding</a>. 
+       <td> An asymmetric key package containing a single <a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey②">private key</a> per <a data-link-type="biblio" href="#biblio-rfc5958" title="Asymmetric Key Packages">[RFC5958]</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑨">Base64url Encoding</a>. 
        <td>string
       <tr>
        <td><var>userHandle</var>
-       <td> The <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑤">userHandle</a> associated to the credential encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②①">Base64url Encoding</a>. This property may not be defined. 
+       <td> The <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑥">userHandle</a> associated to the credential encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③⓪">Base64url Encoding</a>. This property may not be defined. 
        <td>string
       <tr>
        <td><var>signCount</var>
-       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>.
+       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">public key credential source</a>.
        <td>number
       <tr>
        <td><var>largeBlob</var>
-       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a>.
+       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③①">Base64url Encoding</a>.
                     This property may not be defined. 
        <td>string
       <tr>
        <td><var>backupEligibility</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
-                    The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. 
+       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
+                    The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①③">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑤">flag</a> when performing
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>. 
        <td>boolean
       <tr>
        <td><var>backupState</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②①">virtual authenticator</a>'s <var>defaultBackupState</var> property.
-                    The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②③">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">public key credential source</a>. 
+       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupState</var> property.
+                    The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑥">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑥">flag</a> when performing
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. 
        <td>boolean
+      <tr>
+       <td><var>userName</var>
+       <td> The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">user</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⑥">name</a></code> associated to the credential.
+                    If unset, the value will default to the empty string. 
+       <td>string
+      <tr>
+       <td><var>userDisplayName</var>
+       <td> The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑧">user</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①③">displayName</a></code> associated to the credential.
+                    If unset, the value will default to the empty string. 
+       <td>string
     </table>
    </figure>
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps④">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object③">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑦">invalid argument</a>.</p>
+     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object③">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑦">invalid argument</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <var>parameters</var> is a <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters">Credential Parameters</a> object.</p>
     <li data-md>
-     <p>Let <var>credentialId</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②③">Base64url Encoding</a> on the <var>parameters</var>’ <var>credentialId</var> property.</p>
+     <p>Let <var>credentialId</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③②">Base64url Encoding</a> on the <var>parameters</var>’ <var>credentialId</var> property.</p>
     <li data-md>
      <p>If <var>credentialId</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑨">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑨">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑧">invalid argument</a>.</p>
     <li data-md>
@@ -8260,9 +8259,9 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
     <li data-md>
      <p>Let <var>rpId</var> be the <var>parameters</var>’ <var>rpId</var> property.</p>
     <li data-md>
-     <p>If <var>rpId</var> is not a valid <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑨">RP ID</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⓪">invalid argument</a>.</p>
+     <p>If <var>rpId</var> is not a valid <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤④">RP ID</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>privateKey</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②④">Base64url Encoding</a> on the <var>parameters</var>’ <var>privateKey</var> property.</p>
+     <p>Let <var>privateKey</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③③">Base64url Encoding</a> on the <var>parameters</var>’ <var>privateKey</var> property.</p>
     <li data-md>
      <p>If <var>privateKey</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①①">invalid argument</a>.</p>
     <li data-md>
@@ -8272,7 +8271,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>If the <var>parameters</var>’ <var>userHandle</var> property is defined:</p>
      <ol>
       <li data-md>
-       <p>Let <var>userHandle</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑤">Base64url Encoding</a> on the <var>parameters</var>’ <var>userHandle</var> property.</p>
+       <p>Let <var>userHandle</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③④">Base64url Encoding</a> on the <var>parameters</var>’ <var>userHandle</var> property.</p>
       <li data-md>
        <p>If <var>userHandle</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①④">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①④">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①③">invalid argument</a>.</p>
      </ol>
@@ -8285,17 +8284,17 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <p>Let <var>userHandle</var> be <code>null</code>.</p>
      </ol>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database③">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②①">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database③">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑥">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑥">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑤">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②③">Virtual Authenticator</a> matched by <var>authenticatorId</var>.</p>
+     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a> matched by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>If <var>isResidentCredential</var> is <code>true</code> and the <var>authenticator</var>’s <var>hasResidentKey</var> property is <code>false</code>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑥">invalid argument</a>.</p>
     <li data-md>
      <p>If the <var>authenticator</var> supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob③">largeBlob</a> extension and the <var>parameters</var>’ <var>largeBlob</var> feature is defined:</p>
      <ol>
       <li data-md>
-       <p>Let <var>largeBlob</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⑥">Base64url Encoding</a> on the <var>parameters</var>’ <var>largeBlob</var> property.</p>
+       <p>Let <var>largeBlob</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③⑤">Base64url Encoding</a> on the <var>parameters</var>’ <var>largeBlob</var> property.</p>
       <li data-md>
        <p>If <var>largeBlob</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑦">invalid argument</a>.</p>
      </ol>
@@ -8313,24 +8312,35 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Let <var>backupState</var> be the <var>parameters</var>’ <var>backupState</var> property.</p>
     <li data-md>
      <p>If <var>backupState</var> is not defined, set <var>backupState</var> to the value of the <var>authenticator</var>’s <var>defaultBackupState</var>.</p>
+    <li data-md>
+     <p>Let <var>userName</var> be the <var>parameters</var>’ <var>userName</var> property.</p>
+    <li data-md>
+     <p>If <var>userName</var> is not defined, set <var>userName</var> to the empty string.</p>
+    <li data-md>
+     <p>Let <var>userDisplayName</var> be the <var>parameters</var>’ <var>userDisplayName</var> property.</p>
+    <li data-md>
+     <p>If <var>userDisplayName</var> is not defined, set <var>userDisplayName</var> to the empty string.</p>
     <li data-md>
      <p>Let <var>credential</var> be a new <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑦">Client-side discoverable Public Key Credential Source</a> if <var>isResidentCredential</var> is <code>true</code> or a <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source②">Server-side Public Key Credential Source</a> otherwise whose items are:</p>
      <dl>
       <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type④">type</a>
       <dd data-md>
-       <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑥">public-key</a></code></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑦">id</a>
+       <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑦">public-key</a></code></p>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑧">id</a>
       <dd data-md>
        <p><var>credentialId</var></p>
       <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey③">privateKey</a>
       <dd data-md>
        <p><var>privateKey</var></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑨">rpId</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑧">rpId</a>
       <dd data-md>
        <p><var>rpId</var></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑥">userHandle</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑦">userHandle</a>
       <dd data-md>
        <p><var>userHandle</var></p>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui⑥">otherUI</a>
+      <dd data-md>
+       <p>Construct from <var>userName</var> and <var>userDisplayName</var>.</p>
      </dl>
     <li data-md>
      <p>Set the <var>credential</var>’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑦">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑥">credential property</a> to <var>backupEligibility</var>.</p>
@@ -8346,8 +8356,8 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a>, regardless of whether they were
-stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">navigator.credentials.create()</a></code>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②③">Virtual Authenticator</a>, regardless of whether they were
+stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
      <thead>
@@ -8363,18 +8373,18 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑤">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database④">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database④">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑨">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑨">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑧">invalid argument</a>.</p>
     <li data-md>
      <p>Let <var>credentialsArray</var> be an empty array.</p>
     <li data-md>
-     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
-construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
+     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
+construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -8390,19 +8400,19 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑥">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑤">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑤">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⓪">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⓪">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑨">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
-     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
+     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
+     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑨">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -8418,15 +8428,15 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑦">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⓪">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑨">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②①">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③①">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⓪">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verified"><span class="secno">11.9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-user-verified">Set User Verified</dfn></span><a class="self-link" href="#sctn-automation-set-user-verified"></a></h3>
-   <p>The <a data-link-type="dfn" href="#set-user-verified" id="ref-for-set-user-verified">Set User Verified</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑨">extension command</a> sets the <var>isUserVerified</var> property on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③②">Virtual Authenticator</a>. It
+   <p>The <a data-link-type="dfn" href="#set-user-verified" id="ref-for-set-user-verified">Set User Verified</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑨">extension command</a> sets the <var>isUserVerified</var> property on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③①">Virtual Authenticator</a>. It
 is defined as follows:</p>
    <figure class="table" id="table-setUserVerified">
     <table class="data">
@@ -8443,14 +8453,14 @@ <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verif
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑧">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object⑤">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②③">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②③">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②②">invalid argument</a>.</p>
+     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object⑤">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②③">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②③">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②②">invalid argument</a>.</p>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③③">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑦">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③②">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑦">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②④">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②④">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②③">invalid argument</a>.</p>
     <li data-md>
      <p>If <var>isUserVerified</var> is not a defined property of <var>parameters</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑤">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑤">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②④">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③④">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③③">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Set the <var>authenticator</var>’s <var>isUserVerified</var> property to the <var>parameters</var>’ <var>isUserVerified</var> property.</p>
     <li data-md>
@@ -8458,7 +8468,7 @@ <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verif
    </ol>
    <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credential-properties"><span class="secno">11.10. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-credential-properties">Set Credential Properties</dfn></span><a class="self-link" href="#sctn-automation-set-credential-properties"></a></h3>
    <p>The <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties">Set Credential Properties</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands①⓪">extension command</a> allows setting the <var>backupEligibility</var> and <var>backupState</var> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑧">credential properties</a> of
-a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑤">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑥">public key credential source</a>. It is defined as follows:</p>
+a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③④">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">public key credential source</a>. It is defined as follows:</p>
    <figure class="table" id="table-setFlags">
     <table class="data">
      <thead>
@@ -8471,7 +8481,7 @@ <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credentia
        <td><code>/session/{session id}/webauthn/authenticator/{authenticatorId}/credentials/{credentialId}/props</code>
     </table>
    </figure>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-credential-properties-parameters">Set Credential Properties Parameters</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object⑥">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑨">remote end steps</a> as <var>parameters</var>.
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-credential-properties-parameters">Set Credential Properties Parameters</dfn> is a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object⑥">Object</a> passed to the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps⑨">remote end steps</a> as <var>parameters</var>.
 It contains the following <var>key</var> and <var>value</var> pairs:</p>
    <figure class="table" id="table-setCredentialPropertiesParameters">
     <table class="data">
@@ -8494,20 +8504,20 @@ <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credentia
    <p>The <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-remote-end-steps" id="ref-for-dfn-remote-end-steps①⓪">remote end steps</a> are:</p>
    <ol>
     <li data-md>
-     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object⑦">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑥">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑥">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑤">invalid argument</a>.</p>
+     <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-object" id="ref-for-dfn-object⑦">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑥">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑥">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑤">invalid argument</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <var>parameters</var> is a <a data-link-type="dfn" href="#set-credential-properties-parameters" id="ref-for-set-credential-properties-parameters">Set Credential Properties Parameters</a> object.</p>
     <li data-md>
-     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑧">Virtual Authenticator
+     <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑤">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑧">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑥">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑦">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
+     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
     <li data-md>
      <p>If <var>credential</var> is empty, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑦">invalid argument</a>.</p>
     <li data-md>
      <p>Let <var>backupEligibility</var> be the <var>parameters</var>’ <var>backupEligibility</var> property.</p>
     <li data-md>
      <p>If <var>backupEligibility</var> is defined, set the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑨">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties①①">credential property</a> of <var>credential</var> to the value of <var>backupEligibility</var>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑧">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑥">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
     <li data-md>
      <p>Let <var>backupState</var> be the <var>parameters</var>’ <var>backupState</var> property.</p>
     <li data-md>
@@ -8523,7 +8533,7 @@ <h3 class="heading settled" data-level="12.1" id="sctn-att-fmt-reg-update"><span
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: packed</p>
     <li data-md>
-     <p>Description: The "packed" attestation statement format is a WebAuthn-optimized format for <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attestation</a>. It uses a very
+     <p>Description: The "packed" attestation statement format is a WebAuthn-optimized format for <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②③">attestation</a>. It uses a very
 compact but still extensible encoding method. This format is implementable by authenticators with limited resources (e.g.,
 secure elements).</p>
     <li data-md>
@@ -8538,14 +8548,14 @@ <h3 class="heading settled" data-level="12.1" id="sctn-att-fmt-reg-update"><span
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-key</p>
     <li data-md>
-     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
+     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
 attestation" statement.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-key-attestation">§ 8.4 Android Key Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-safetynet</p>
     <li data-md>
-     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform authenticators</a> MAY produce an attestation statement based on the Android
+     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">platform authenticators</a> MAY produce an attestation statement based on the Android
 SafetyNet API.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-safetynet-attestation">§ 8.5 Android SafetyNet Attestation Statement Format</a> of this specification <br><br></p>
@@ -8562,13 +8572,13 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: apple</p>
     <li data-md>
-     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a></p>
+     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform authenticators</a></p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-apple-anonymous-attestation">§ 8.8 Apple Anonymous Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: none</p>
     <li data-md>
-     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
+     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> of this specification</p>
    </ul>
@@ -8578,18 +8588,10 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥①">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
-    <li data-md>
-     <p>WebAuthn Extension Identifier: uvm</p>
-    <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②④">authentication extension</a> enables use of a user verification method.
-The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a> which user verification methods (factors) were
-used for the WebAuthn operation.</p>
-    <li data-md>
-     <p>Specification Document: Section <a href="#sctn-uvm-extension">§ 10.2.1 User Verification Method Extension (uvm)</a> of this specification</p>
    </ul>
    <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span class="secno">12.4. </span><span class="content">WebAuthn Extension Identifier Registrations</span><a class="self-link" href="#sctn-extensions-reg"></a></h3>
    <p>This section registers the below-listed <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②⑥">extension identifier</a> values, newly defined in Section <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>, in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
@@ -8597,110 +8599,110 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: appidExclude</p>
     <li data-md>
-     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥②">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.1.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑤">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a>'s properties,
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥③">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⑤">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
-The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> as to their provenance.</p>
+The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥④">WebAuthn Relying Party</a>'s
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
-Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> security characteristics.</p>
+Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
-   <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
-This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥⓪">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a>), and thus the interaction would end in an error.</p>
+   <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
+This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> returns
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑤">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
 For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
-must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>.
-This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> that can be invoked remotely —
-even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
+must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>.
+This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> that can be invoked remotely —
+even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> has to trust the third party to
-enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>.
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> has to trust the third party to
+enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
-and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
-   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
+and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
+   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span class="secno">13.3.1. </span><span class="content">Attestation Certificate Hierarchy</span><a class="self-link" href="#sctn-cert-hierarchy"></a></h4>
    <p>A 3-tier hierarchy for attestation certificates is RECOMMENDED (i.e., Attestation Root, Attestation Issuing CA, Attestation
-Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
+Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
 used to help facilitate isolating problems with a specific version of an authenticator model.</p>
-   <p>If the attestation root certificate is not dedicated to a single <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticator</a> device line (i.e., AAGUID), the AAGUID
-SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥①">authenticator data</a>.</p>
+   <p>If the attestation root certificate is not dedicated to a single <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①②">WebAuthn Authenticator</a> device line (i.e., AAGUID), the AAGUID
+SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a>.</p>
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
-   <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①②">WebAuthn Authenticator</a> manufacturer that
-has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
-intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Parties</a> MUST update their trusted root certificates
+   <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer that
+has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificates</a> for these keys from a new
+intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑥">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
-   <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">private key</a> has been compromised. A WebAuthn
-Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
-manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
-scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+   <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">private key</a> has been compromised. A WebAuthn
+Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">certificates</a> into already
+manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
+scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
-   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Parties</a> by this specification include:</p>
+   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑦">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> can optionally
-enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticators</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> can optionally
+enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticators</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
-Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
+     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
+Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a> - for example PIN, biometrics and/or future
-methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
+methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
-to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①③">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>Challenges SHOULD be valid for a duration similar to the
@@ -8709,129 +8711,133 @@ <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenge
 therefore be at least 16 bytes long.</p>
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
-However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> was generated
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
-to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⓪">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
+   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a>, if present,
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑧">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> qualities.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
+However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a>, on its own,
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a> was generated
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> maintains
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑧">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>: unscathed
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③④">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> reports
-a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> model than the user expects.</p>
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> reports
+a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> also
-un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
-after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
-related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> also
+un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">public key credentials</a> that were registered
+after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
+related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
-multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to the
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
-different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑧">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code></code> options to ensure that these
+different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument risks leaking information
-about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a> have WebAuthn credentials registered and which do not,
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> argument risks leaking information
+about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
-For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
-and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>.
-The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> for successful authentication,
+For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a> by providing only a username,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a>,
+and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>.
+The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
-and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑨">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑨">origins</a>.</p>
     <li data-md>
-     <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a>.
-For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+     <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.
+For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⓪">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑥">RP ID</a> <code>example.org</code>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑧">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①⓪">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credentials</a>.</p>
    </ul>
    <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><span class="secno">13.4.9. </span><span class="content">Validating the origin of a credential</span><a class="self-link" href="#sctn-validating-origin"></a></h4>
    <p>When <a href="#rp-op-registering-a-new-credential-step-origin">registering a credential</a> and
 when <a href="#rp-op-verifying-assertion-step-origin">verifying an assertion</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
-   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
-as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credentials</a>.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
+   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
+as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③①">credentials</a>.
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of WebAuthn credentials prevents their use on domains
-outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤②">RP ID</a> they were registered for,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a>'s origin validation serves as an additional layer of protection
-in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
+outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑦">RP ID</a> they were registered for,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a>'s origin validation serves as an additional layer of protection
+in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
-   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>.
+   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
      <p>A web application served only at <code>https://example.org</code> SHOULD require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①④">origin</a></code> to exactly equal <code>https://example.org</code>.</p>
      <p>This is the simplest case, where <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑤">origin</a></code> is expected
-to be the string <code>https://</code> followed by the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤③">RP ID</a>.</p>
+to be the string <code>https://</code> followed by the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑧">RP ID</a>.</p>
     <li data-md>
      <p>A web application served at a small number of domains might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑥">origin</a></code> to exactly equal some element of a list of allowed origins,
 for example the list <code>["https://example.org", "https://login.example.org"]</code>.</p>
     <li data-md>
-     <p>A web application served at a large set of domains that changes often might parse <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑦">origin</a></code> structurally and require that the URL scheme is <code>https</code> and that the authority equals or is any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤④">RP ID</a> - for example, <code>example.org</code> or any subdomain of <code>example.org</code>).</p>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.</p>
+     <p>A web application leveraging <a href="#sctn-related-origins">related origin requests</a> might also require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑦">origin</a></code> to exactly equal some element of a list of allowed origins,
+for example the list <code>["https://example.co.uk", "https://example.de", "https://myexamplerewards.com"]</code>.
+This list will typically match the origins listed in the well-known URI for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑨">RP ID</a>. See <a href="#sctn-related-origins">§ 5.11 Using Web Authentication across related origins</a>.</p>
+    <li data-md>
+     <p>A web application served at a large set of domains that changes often might parse <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑧">origin</a></code> structurally and require that the URL scheme is <code>https</code> and that the authority equals or is any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥⓪">RP ID</a> - for example, <code>example.org</code> or any subdomain of <code>example.org</code>).</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥①">RP ID</a>.</p>
     <li data-md>
-     <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑧">origin</a></code> to be an operating system dependent
-identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
+     <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> to be an operating system dependent
+identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②⓪">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
-   <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> MUST validate that its value is expected.
-This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>.
+   <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①③">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> MUST validate that its value is expected.
+This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
-     <p>A web application that does not wish to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑤">iframe</a></code> might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①③">topOrigin</a></code> to exactly equal <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②⓪">origin</a></code>.</p>
+     <p>A web application that does not wish to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code> might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑤">topOrigin</a></code> to exactly equal <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②①">origin</a></code>.</p>
     <li data-md>
-     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑥">iframe</a></code> on a small number of domains
-might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> to exactly equal some element of a list of allowed origins,
+     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑤">iframe</a></code> on a small number of domains
+might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑥">topOrigin</a></code> to exactly equal some element of a list of allowed origins,
 for example the list <code>["https://example-partner1.org", "https://login.partner2-example.org"]</code>.</p>
     <li data-md>
-     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑦">iframe</a></code> on a large number of domains
-might allow any value of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑤">topOrigin</a></code>, or use a dynamic procedure
-to determine whether a given <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑥">topOrigin</a></code> value is allowed for a particular ceremony.</p>
+     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑥">iframe</a></code> on a large number of domains
+might allow any value of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑦">topOrigin</a></code>, or use a dynamic procedure
+to determine whether a given <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑧">topOrigin</a></code> value is allowed for a particular ceremony.</p>
    </ul>
    <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><span class="secno">14. </span><span class="content">Privacy Considerations</span><a class="self-link" href="#sctn-privacy-considerations"></a></h2>
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -8841,164 +8847,168 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
 form of global identity, the following kinds of potentially correlatable identifiers are used:</p>
    <ul>
     <li data-md>
-     <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a>.</p>
+     <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑨">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> depending on the implementation.</p>
     <li data-md>
-     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
+     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticators</a>, e.g., product names.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
     <li data-md>
-     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>.</p>
+     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticators</a>, e.g., serial numbers.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①②①">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Parties</a> from using it to discover a user’s personal identity.</p>
-   <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⓪">WebAuthn Relying Party</a> to enable strong
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a>.</p>
    <ul>
     <li data-md>
-     <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑦">credential key pairs</a> and not users directly.</p>
+     <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①②②">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①②③">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②④">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a> registered and available.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a> thus cannot correlate users between their
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">public key credentials</a> are
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a>.</p>
-   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦①">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑦">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a>.</p>
+   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
+   <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
 or link various online identities of the same user together.
 This can be mitigated in several ways, including:</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticators</a> in batches
-where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
-This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">private key</a> is compromised.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑨">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticators</a> in batches
+where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
+This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">private key</a> is compromised.
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
 while also minimizing the batch size in order to limit the number of affected users
-in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> is compromised.</p>
-     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
+in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">attestation private key</a> is compromised.</p>
+     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">attestation certificate</a> in order to produce
 sufficiently large groups. This may serve as guidance about suitable batch sizes.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticator</a> can ship with a
-main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑨">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificate</a>),
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②⓪">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③②">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> can ship with a
+main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">certificate</a>),
 and combined with a cloud-operated <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑦">Anonymization CA</a>,
-can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">attestation certificates</a>.</p>
+can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③③">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②②">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> In various places outside this specification, the term "Privacy CA" is used to refer to what is termed here
     as an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑧">Anonymization CA</a>. Because the Trusted Computing Group (TCG) also used the term "Privacy CA" to refer to what
     the TCG now refers to as an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca③">Attestation CA</a> (ACA) <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a>, we are using the term <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑨">Anonymization CA</a> here to try to mitigate
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication
-ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> has been
-performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> SHOULD NOT store personally identifying information.</p>
-   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
-   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①②⑥">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑦">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication
+ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> has been
+performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a> SHOULD NOT store personally identifying information.</p>
+   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①①">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑨">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
+   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a>'s enrolled user(s).</p>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①②⑧">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a>:</p>
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑧">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a>:</p>
    <ul>
     <li data-md>
-     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticators</a> are present.</p>
+     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticators</a> are present.</p>
     <li data-md>
-     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> is excluded.</p>
+     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> could identify the user by probing for
-which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
-timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
-   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> could identify the user by probing for
+which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credentials</a> are available. For example, one such information leak is if the client returns a
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
+before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
+   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credential</a> is not available.</p>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧③">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> could identify the user by probing
-for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
-one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> parameter is
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> could identify the user by probing
+for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧④">credentials</a> are available.
+For example, one such information leak may happen if the client displays instructions and controls
+for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑤">credential</a>.
+In this case, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> is aware of this <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">client</a> behavior,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⑤">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> parameter is
 available to the user.</p>
+   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremony</a> at any time,
+regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑥">credentials</a> are available.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
-   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform
+   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities①">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑥">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
-and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a>, since hashing does not prevent probing for guessable input
-values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a>.</p>
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a>, since hashing does not prevent probing for guessable input
+values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a> may implement to mitigate or prevent information
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> responds with a failure, but then
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
 send a message to this address, containing an unpredictable one-time code and instructions for how to use it to
 proceed with the ceremony. Display the same message to the user in the web interface regardless of the contents of the
 sent e-mail and whether or not this e-mail address was already registered.</p>
@@ -9008,23 +9018,23 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> matching the provided username, continue the
-ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
-       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code>;
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
+ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
+       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
-    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> member could therefore be populated with pseudo-random values
+    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
 before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
@@ -9032,34 +9042,37 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤②">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①③">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Parties</a>,
-so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> and their lengths
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> argument risks leaking personally identifying information,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑥">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>,
+so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑦">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑦">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
-Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑤">Relying Party</a> could for example:</p>
+Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑧">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticators</a>.</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
     <li data-md>
      <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
-so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑦">allowCredentials</a></code> argument is not needed.</p>
+so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> argument is not needed.</p>
    </ul>
    <p>If the above prevention measures are not available,
-i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑥">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑨">allowCredentials</a></code> needs to be exposed given only a username,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+   <p>When <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑥">signalling</a> that a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥①">credential id</a> was not recognized,
+the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
+exposing <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥②">credential IDs</a> to an unauthenticated caller.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑦">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑧">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -9067,7 +9080,662 @@ <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range
     <li data-md>
      <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
    </ul>
-   <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span class="secno">16. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
+   <h2 class="heading settled" data-level="16" id="sctn-test-vectors"><span class="secno">16. </span><span class="content">Test Vectors</span><a class="self-link" href="#sctn-test-vectors"></a></h2>
+   <p><em>This section is not normative.</em></p>
+   <p>This section lists example values that may be used to validate implementations.</p>
+   <p>Examples are given as pseudocode in pairs of <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremonies</a> done with the same <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑦">credential</a>,
+with byte string literals and comments in CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> notation.
+The examples are not exhaustive and do not include <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⑤">WebAuthn extensions</a>.</p>
+   <p>The examples are structured as a flow from inputs to outputs, including some intermediate values.
+In registration examples the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a> defines the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> input,
+the <a data-link-type="dfn" href="#client" id="ref-for-client①③⓪">client</a> generates the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①①">clientDataJSON</a></code> output
+and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticator</a> generates the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑨">attestationObject</a></code> output.
+In authentication examples the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> defines the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge⑤">challenge</a></code> input,
+the <a data-link-type="dfn" href="#client" id="ref-for-client①③①">client</a> generates the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①②">clientDataJSON</a></code> output
+and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticator</a> generates the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata③">authenticatorData</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature③">signature</a></code> outputs.
+Other cryptographically unrelated inputs and outputs are not included.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⑤">Authenticator</a> implementers may check that they produce similarly structured <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject①⓪">attestationObject</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata④">authenticatorData</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature④">signature</a></code> outputs. <a data-link-type="dfn" href="#client" id="ref-for-client①③②">Client</a> implementers may check that they produce similarly structured <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①③">clientDataJSON</a></code> outputs. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a> implementers may check that they can successfully validate the registration outputs
+given the same <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge⑤">challenge</a></code> input,
+and that they can successfully validate the authentication outputs
+given the same <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge⑥">challenge</a></code> input
+and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④②">credential public key</a> and <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥③">credential ID</a> from the associated registration example.</p>
+   <p>All examples use the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥②">RP ID</a> <code>example.org</code>, the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②②">origin</a></code> <code>https://example.org</code> and, where applicable, the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑨">topOrigin</a></code> <code>https://example.com</code>.
+Examples include <a data-link-type="dfn" href="#none" id="ref-for-none⑨">no attestation</a> when not noted otherwise.</p>
+   <p>All random values are deterministically generated using HKDF-SHA-256 <a data-link-type="biblio" href="#biblio-rfc5869" title="HMAC-based Extract-and-Expand Key Derivation Function (HKDF)">[RFC5869]</a> from the base input key material denoted in CDDL as <code>'WebAuthn test vectors'</code>,
+or equivalently as <code>h’576562417574686e207465737420766563746f7273'</code>.
+ECDSA signatures use a deterministic nonce <a data-link-type="biblio" href="#biblio-rfc6979" title="Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)">[RFC6979]</a>.
+The RSA key in the examples is constructed from the two smallest Mersenne primes 2<sup>p</sup> - 1 such that p ≥ 1024.</p>
+   <p>Note that:</p>
+   <ul>
+    <li data-md>
+     <p>Although the examples include <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a> and <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑨">attestation private keys</a> for reproducibility,
+these would normally not be shared with the <a data-link-type="dfn" href="#client" id="ref-for-client①③③">client</a> or <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a>.</p>
+    <li data-md>
+     <p>Although each example uses a different <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, the <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a> would normally be constant for a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⑥">authenticator</a>.</p>
+   </ul>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⑦">Authenticators</a> implementing CTAP2 <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> return <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⓪">attestation objects</a> using different keys than those defined in this specification.
+These examples reflect the attestation object format expected by <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑦">WebAuthn Relying Parties</a>,
+so <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②①">attestation objects</a> emitted from CTAP2 need their keys translated
+in order to be bitwise identical to these examples.</p>
+   <h3 class="heading settled" data-level="16.1" id="sctn-test-vectors-attestation-root-cert"><span class="secno">16.1. </span><span class="content">Attestation trust root certificate</span><a class="self-link" href="#sctn-test-vectors-attestation-root-cert"></a></h3>
+   <p>All examples that include <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> use the attestation trust root certificate
+given as <code>attestation_ca_cert</code> below, encoded in X.509 DER <a data-link-type="biblio" href="#biblio-rfc5280" title="Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile">[RFC5280]</a>:</p>
+<pre class="example highlight" id="example-e9825bc2"><a class="self-link" href="#example-e9825bc2"></a><c- nc>attestation_ca_key</c-> <c- o>=</c-> h<c- t>'7809337f05740a96a78eedf9e9280499dcc8f2aa129616049ec1dccfe103eb2a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='Attestation CA', L=32)</c->
+<c- nc>attestation_ca_serial_number</c-> <c- o>=</c-> h<c- t>'ed7f905d8bd0b414d1784913170a90b6'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='Attestation CA', L=16)</c->
+<c- nc>attestation_ca_cert</c-> <c- o>=</c-> h<c- t>'30820207308201ada003020102021100ed7f905d8bd0b414d1784913170a90b6300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a3062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d030107034200043269300e5ff7b699015f70cf80a8763bf705bc2e2af0c1b39cff718b7c35880ca30f319078d91b03389a006fdfc8a1dcd84edfa07d30aa13474a248a0dab5baaa3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d04030203480030450220483063b6bb08dcc83da33a02c11d2f42203176893554d138c614a36908724cc8022100f5ef2c912d4500b3e2f5b591d0622491e9f220dfd1f9734ec484bb7e90887663'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.1" id="sctn-test-vectors-none-es256"><span class="secno">16.1.1. </span><span class="content">ES256 Credential with No Attestation</span><a class="self-link" href="#sctn-test-vectors-none-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑨">Registration</a>:</p>
+<pre class="example highlight" id="example-8cefb2db"><a class="self-link" href="#example-8cefb2db"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'00c30fb78531c464d2b6771dab8d7b603c01162f2fa486bea70f283ae556e130'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='none.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'6e68e7a58484a3264f66b77f5d6dc5bc36a47085b615c9727ab334e8c369c2ee'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='none.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'f9'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='none.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'06441e0e375c4c1ad70620302532c4e5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='none.ES256', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'8446ccb9ab1db374750b2367ff6f3a1f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='none.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'f91f391db4c9b2fde0ea70189cba3fb63f579ba6122b33ad94ff3ec330084be4'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='none.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'ba'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='none.ES256', L=1)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22414d4d507434557878475453746e63647134313759447742466938767049612d7077386f4f755657345441222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a20426b5165446a646354427258426941774a544c4535513d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74646e6f6e656761747453746d74a068617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b559000000008446ccb9ab1db374750b2367ff6f3a1f0020f91f391db4c9b2fde0ea70189cba3fb63f579ba6122b33ad94ff3ec330084be4a5010203262001215820afefa16f97ca9b2d23eb86ccb64098d20db90856062eb249c33a9b672f26df61225820930a56b87a2fca66334b03458abf879717c12cc68ed73290af2e2664796b9220'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">Authentication</a>:</p>
+<pre class="example highlight" id="example-33ff9105"><a class="self-link" href="#example-33ff9105"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'39c0e7521417ba54d43e8dc95174f423dee9bf3cd804ff6d65c857c9abf4d408'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='none.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'4a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='none.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'38'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='none.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b51900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a224f63446e55685158756c5455506f334a5558543049393770767a7a59425039745a63685879617630314167222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3046022100f50a4e2e4409249c4a853ba361282f09841df4dd4547a13a87780218deffcd380221008480ac0f0b93538174f575bf11a1dd5d78c6e486013f937295ea13653e331e87'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.2" id="sctn-test-vectors-packed-self-es256"><span class="secno">16.1.2. </span><span class="content">ES256 Credential with Self Attestation</span><a class="self-link" href="#sctn-test-vectors-packed-self-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⓪">Registration</a>:</p>
+<pre class="example highlight" id="example-787642a9"><a class="self-link" href="#example-787642a9"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'7869c2b772d4b58eba9378cf8f29e26cf935aa77df0da89fa99c0bdc0a76f7e5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed-self.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'b4bbfa5d68e1693b6ef5a19a0e60ef7ee2cbcac81f7fec7006ac3a21e0c5116a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed-self.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'db'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed-self.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'53d8535ef284d944643276ffd3160756'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed-self.ES256', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'df850e09db6afbdfab51697791506cfc'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed-self.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'455ef34e2043a87db3d4afeb39bbcb6cc32df9347c789a865ecdca129cbef58c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed-self.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'fd'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed-self.ES256', L=1)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a2265476e4374334c55745936366b336a506a796e6962506b31716e666644616966715a774c33417032392d55222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a205539685458764b453255526b4d6e625f3078594856673d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a263616c67266373696758483046022100ae045923ded832b844cae4d5fc864277c0dc114ad713e271af0f0d371bd3ac540221009077a088ed51a673951ad3ba2673d5029bab65b64f4ea67b234321f86fcfac5d68617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b55d00000000df850e09db6afbdfab51697791506cfc0020455ef34e2043a87db3d4afeb39bbcb6cc32df9347c789a865ecdca129cbef58ca5010203262001215820eb151c8176b225cc651559fecf07af450fd85802046656b34c18f6cf193843c5225820927b8aa427a2be1b8834d233a2d34f61f13bfd44119c325d5896e183fee484f2'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑥">Authentication</a>:</p>
+<pre class="example highlight" id="example-4a6ac41c"><a class="self-link" href="#example-4a6ac41c"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'4478a10b1352348dd160c1353b0d469b5db19eb91c27f7dfa6fed39fe26af20b'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed-self.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'1f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed-self.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'8136f9debcfa121496a265c6ce2982d5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed-self.ES256', L=16)</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'a1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='packed-self.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a225248696843784e534e493352594d45314f7731476d3132786e726b634a5f6666707637546e2d4a71386773222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a206754623533727a36456853576f6d58477a696d4331513d3d227d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3044022076691be76a8618976d9803c4cdc9b97d34a7af37e3bdc894a2bf54f040ffae850220448033a015296ffb09a762efd0d719a55346941e17e91ebf64c60d439d0b9744'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.3" id="sctn-test-vectors-none-es256-crossOrigin"><span class="secno">16.1.3. </span><span class="content">ES256 Credential with "crossOrigin": true in clientDataJSON</span><a class="self-link" href="#sctn-test-vectors-none-es256-crossOrigin"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③①">Registration</a>:</p>
+<pre class="example highlight" id="example-9c9fe230"><a class="self-link" href="#example-9c9fe230"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'3be5aacd03537142472340ab5969f240f1d87716e20b6807ac230655fa4b3b49'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='none.ES256.crossOrigin', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'96c940e769bd9f1237c119f144fa61a4d56af0b3289685ae2bef7fb89620623d'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='none.ES256.crossOrigin', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'71'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='none.ES256.crossOrigin', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'cd9aae12d0d1f435aaa56e6d0564c5ba'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='none.ES256.crossOrigin', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'883f4f6014f19c09d87aa38123be48d0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='none.ES256.crossOrigin', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'6e1050c0d2ca2f07c755cb2c66a74c64fa43065c18f938354d9915db2bd5ce57'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='none.ES256.crossOrigin', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'27'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='none.ES256.crossOrigin', L=1)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a224f2d57717a514e5463554a484930437257576e7951504859647862694332674872434d475666704c4f306b222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a747275652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a207a5a71754574445239445771705735744257544675673d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74646e6f6e656761747453746d74a068617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54500000000883f4f6014f19c09d87aa38123be48d000206e1050c0d2ca2f07c755cb2c66a74c64fa43065c18f938354d9915db2bd5ce57a501020326200121582022200a473f90b11078851550d03b4e44a2279f8c4eca27b3153dedfe03e4e97d225820cbd0be95e746ad6f5a8191be11756e4c0420e72f65b466d39bc56b8b123a9c6e'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑦">Authentication</a>:</p>
+<pre class="example highlight" id="example-86ef4388"><a class="self-link" href="#example-86ef4388"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'876aa517ba83fdee65fcffdbca4c84eeae5d54f8041a1fc85c991e5bbb273137'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='none.ES256.crossOrigin', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'57'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='none.ES256.crossOrigin', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'f76a5c4d50f401bcbeab876d9a3e9e7e'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='none.ES256.crossOrigin', L=16)</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'0c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='none.ES256.crossOrigin', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50500000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a226832716c463771445f65356c5f505f62796b7945377135645650674547685f49584a6b655737736e4d5463222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a747275652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a2039327063545644304162792d713464746d6a366566673d3d227d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'304402204396b14b216ed47920dc359e46aa0a1d4a912cf9d50f25a58ec236a11db4cf5e02204fdb59ff01656c4b0868e415436a464b0e30e94b02c719b995afaba9c917146b'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.4" id="sctn-test-vectors-none-es256-topOrigin"><span class="secno">16.1.4. </span><span class="content">ES256 Credential with "topOrigin" in clientDataJSON</span><a class="self-link" href="#sctn-test-vectors-none-es256-topOrigin"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③②">Registration</a>:</p>
+<pre class="example highlight" id="example-e2cdaa81"><a class="self-link" href="#example-e2cdaa81"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'4e1f4c6198699e33c14f192153f49d7e0e8e3577d5ac416c5f3adc92a41f27e5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='none.ES256.topOrigin', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'a2d6de40ab974b80d8c1ef78c6d4300097754f7e016afe7f8ea0ad9798b0d420'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='none.ES256.topOrigin', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'54'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='none.ES256.topOrigin', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'97586fd09799a76401c200455099ef2a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='none.ES256.topOrigin', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'b8ad59b996047ab18e2ceb57206c362da57458793481f4a8ebf101c7ca7cc0f1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='none.ES256.topOrigin', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'a0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='none.ES256.topOrigin', L=1)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a225468394d595a68706e6a504254786b68555f53646667364f4e58665672454673587a72636b7151664a2d55222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a747275652c22746f704f726967696e223a2268747470733a2f2f6578616d706c652e636f6d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74646e6f6e656761747453746d74a068617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b5410000000097586fd09799a76401c200455099ef2a0020b8ad59b996047ab18e2ceb57206c362da57458793481f4a8ebf101c7ca7cc0f1a5010203262001215820a1c47c1d82da4ebe82cd72207102b380670701993bc35398ae2e5726427fe01d22582086c1080d82987028c7f54ecb1b01185de243b359294a0ed210cd47480f0adc88'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑧">Authentication</a>:</p>
+<pre class="example highlight" id="example-a3ac8b2a"><a class="self-link" href="#example-a3ac8b2a"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'d54a5c8ca4b62a8e3bb321e3b2bc73856f85a10150db2939ac195739eb1ea066'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='none.ES256.topOrigin', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'77'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='none.ES256.topOrigin', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'52216824c5514070c0156162e2fc54a5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='none.ES256.topOrigin', L=16)</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'9f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='none.ES256.topOrigin', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50500000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22315570636a4b53324b6f34377379486a7372787a68572d466f51465132796b3572426c584f6573656f4759222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a747275652c22746f704f726967696e223a2268747470733a2f2f6578616d706c652e636f6d222c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a205569466f4a4d565251484441465746693476785570513d3d227d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'304402206a19613fa8cfacfc8027272aec5dae3555fea9f983d841581466678d71e6761a02207a9785ba22e48eb18525850357d9dc70795aaad2e6021159c4a4a183146eaa71'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.5" id="sctn-test-vectors-none-es256-long-credential-id"><span class="secno">16.1.5. </span><span class="content">ES256 Credential with very long credential ID</span><a class="self-link" href="#sctn-test-vectors-none-es256-long-credential-id"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③③">Registration</a>:</p>
+<pre class="example highlight" id="example-fdcf21fc"><a class="self-link" href="#example-fdcf21fc"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'1113c7265ccf5e65124282fa1d7819a7a14cb8539aa4cdbec7487e5f35d8ec6c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='none.ES256.long-credential-id', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'6fd2149bb5f1597fe549b138794bde61893b2dc32ca316de65f04808dac211dc'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='none.ES256.long-credential-id', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'90'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='none.ES256.long-credential-id', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'8f3360c2cd1b0ac14ffe0795c5d2638e'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='none.ES256.long-credential-id', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'3a761a4e1674ad6c4305869435c0eee9c286172c229bb91b48b4ada140c0863417031305cce5b4a27a88d7fe728a5f5a627de771b4b40e77f187980c124f9fe832d7136010436a056cce716680587d23187cf1fc2c62ae86fc3e508ee9617ffc74fbc10488ec16ec5e9096328669a898709b655e549738c666c1ae6281dc3b5f733c251d3eefb76ee70a3805ca91bcc18e49c8dc7f63ebcb486ba8c3d6ab52b88ff72c6a5bb47c32f3ee8683a3ddc8abf60870448ec8a21b5bdcb183c7dead870255575a6df96eb1b6a2a1019780cba9e4887b17ff1164bbbcc10eb0d86ed75984cd3fa3419103024507dfd9ce8f92c56af7914cb0bb50b87ba82a312bb7dcd93028dbdcd6adb266979667158335171e3682d37755701edbf9d872846a291d49e57ef09da1ec637f5052ed2aa7407f7e61827468e94b461844f4c67be5fa9c6055a566f8fdfc29d4bf78a9ff275f552cc68ba543fa3962eea36fd1ea8453764577d021d0a181efc1f6100ab2e4110039e21ee16970bda7432b6134492155afc126295b3a2eccd12c66a68e340969e995e3e8c9c476e395cfc21203414110779474f1c9797406637dbe414f132519d3bf0ce4f01734ef0e1a12c3ad604ff15d766b1624db6a5a7ccbff7bc35c9908df94aba277e0af48f04ff3d16381c47e5a37ed3988a67a3b1ecaa926336b33391fff04128f869991c9fabd905b6fe3ceef5f8b630ec1c5d2636d5b1961ad5ca5004170f6f5e482792aad989b0287fe91e5c479403397152f1fa56aa79b156eb47e6c8ea3eb175c34cfb38ad8e772874639b1023d4d01395c94e55831671cc022aa6fa1e02a02c2e4abc776f6960e51f83b71a8c0f207b6a347573977812c9aa5480b0011aa739bd4b76c18c000cc4757cceccb920f007c40c00e37e5ab21476cd9f6054a8fffb55a108f5c706e2cea2049d81fd321ff47d2a5761b0800955ab1d4f4889f55a84e2601c684f17a4ade7453ea49591d0b59c8d9a765052f62219cf6ef4a5dd9539f0617d6ebbebce7c000455475d18449e25c49ef9a1e3efe18c09082ebe2058d7c347defaa92f0664553b805c7d76bbfce5f330aca220ac90a789380fc479ea0d8793205813cca590a912f699ad52f991a1bc0a503c3ec4b2a696719e3c26591a87127f7305cc7e72f4c8e39355ebb06a5b1042990f38710ee7aa612ee4374bb82e878585a70a96c2a6b47f101a4ff154be4fd76a3167577a5cc54d9167c154c69ac35485e44cc898b719e1be3cc9c0fb5624b8f8a0dae10947a41bf848b6c1bb33d1006ec077d7e286e3f2a7b4843716390119449fe2721e81a5ed2333d331c7120765da58fadae73c19d9a8c4509cf8ac1e9d98b799a5274509069739b5823f3fb496663820033426988eefca53e580e0f9e0dfe0992fc2e53a97e053639f98577058f995bdbd41cefdb'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='none.ES256.long-credential-id', L=1023)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'69'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='none.ES256.long-credential-id', L=1)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22455250484a6c7a50586d5553516f4c364858675a7036464d75464f61704d322d7830682d587a5859374777222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74646e6f6e656761747453746d74a0686175746844617461590483bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b549000000008f3360c2cd1b0ac14ffe0795c5d2638e03ff3a761a4e1674ad6c4305869435c0eee9c286172c229bb91b48b4ada140c0863417031305cce5b4a27a88d7fe728a5f5a627de771b4b40e77f187980c124f9fe832d7136010436a056cce716680587d23187cf1fc2c62ae86fc3e508ee9617ffc74fbc10488ec16ec5e9096328669a898709b655e549738c666c1ae6281dc3b5f733c251d3eefb76ee70a3805ca91bcc18e49c8dc7f63ebcb486ba8c3d6ab52b88ff72c6a5bb47c32f3ee8683a3ddc8abf60870448ec8a21b5bdcb183c7dead870255575a6df96eb1b6a2a1019780cba9e4887b17ff1164bbbcc10eb0d86ed75984cd3fa3419103024507dfd9ce8f92c56af7914cb0bb50b87ba82a312bb7dcd93028dbdcd6adb266979667158335171e3682d37755701edbf9d872846a291d49e57ef09da1ec637f5052ed2aa7407f7e61827468e94b461844f4c67be5fa9c6055a566f8fdfc29d4bf78a9ff275f552cc68ba543fa3962eea36fd1ea8453764577d021d0a181efc1f6100ab2e4110039e21ee16970bda7432b6134492155afc126295b3a2eccd12c66a68e340969e995e3e8c9c476e395cfc21203414110779474f1c9797406637dbe414f132519d3bf0ce4f01734ef0e1a12c3ad604ff15d766b1624db6a5a7ccbff7bc35c9908df94aba277e0af48f04ff3d16381c47e5a37ed3988a67a3b1ecaa926336b33391fff04128f869991c9fabd905b6fe3ceef5f8b630ec1c5d2636d5b1961ad5ca5004170f6f5e482792aad989b0287fe91e5c479403397152f1fa56aa79b156eb47e6c8ea3eb175c34cfb38ad8e772874639b1023d4d01395c94e55831671cc022aa6fa1e02a02c2e4abc776f6960e51f83b71a8c0f207b6a347573977812c9aa5480b0011aa739bd4b76c18c000cc4757cceccb920f007c40c00e37e5ab21476cd9f6054a8fffb55a108f5c706e2cea2049d81fd321ff47d2a5761b0800955ab1d4f4889f55a84e2601c684f17a4ade7453ea49591d0b59c8d9a765052f62219cf6ef4a5dd9539f0617d6ebbebce7c000455475d18449e25c49ef9a1e3efe18c09082ebe2058d7c347defaa92f0664553b805c7d76bbfce5f330aca220ac90a789380fc479ea0d8793205813cca590a912f699ad52f991a1bc0a503c3ec4b2a696719e3c26591a87127f7305cc7e72f4c8e39355ebb06a5b1042990f38710ee7aa612ee4374bb82e878585a70a96c2a6b47f101a4ff154be4fd76a3167577a5cc54d9167c154c69ac35485e44cc898b719e1be3cc9c0fb5624b8f8a0dae10947a41bf848b6c1bb33d1006ec077d7e286e3f2a7b4843716390119449fe2721e81a5ed2333d331c7120765da58fadae73c19d9a8c4509cf8ac1e9d98b799a5274509069739b5823f3fb496663820033426988eefca53e580e0f9e0dfe0992fc2e53a97e053639f98577058f995bdbd41cefdba50102032620012158203b8176b7504489cc593046d7988abb7905a742de6ac2cdc748a873c663e90cb12258201436d5edc9a75f23999eef9d5950a5c2455514ee1014084720f841a06b828a11'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑨">Authentication</a>:</p>
+<pre class="example highlight" id="example-a7d292f2"><a class="self-link" href="#example-a7d292f2"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'ef1deba56dce48f674a447ccf63b9599258ce87648e5c396f2ef0ca1da460e3b'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='none.ES256.long-credential-id', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'80'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='none.ES256.long-credential-id', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'e5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='none.ES256.long-credential-id', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50d00000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22377833727057334f53505a307045664d396a75566d53574d36485a4935634f573875384d6f647047446a73222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'304502203ecef83fb12a0cae7841055f9f87103a99fd14b424194bbf06c4623d3ee6e3fd022100d2ace346db262b1374a6b70faa51f518a42ddca13a4125ce6f5052a75bac9fb6'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.6" id="sctn-test-vectors-packed-es256"><span class="secno">16.1.6. </span><span class="content">Packed Attestation with ES256 Credential</span><a class="self-link" href="#sctn-test-vectors-packed-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③④">Registration</a>:</p>
+<pre class="example highlight" id="example-326b5286"><a class="self-link" href="#example-326b5286"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'c1184a5fddf8045e13dc47f54b61f5a656b666b59018f16d870e9256e9952012'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'36ed7bea2357cefa8c4ec7e134f3312d2e6ca3058519d0bcb4c1424272010432'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'8d'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'f5af1b3588ca0a05ab05753e7c29756a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed.ES256', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'876ca4f52071c3e9b25509ef2cdf7ed6'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'c9a6f5b3462d02873fea0c56862234f99f081728084e511bb7760201a89054a5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'4f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed.ES256', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'ec2804b222552b4b277d1f58f8c4343c0b0b0db5474eb55365c89d66a2bc96be'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed.ES256', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'88c220f83c8ef1feafe94deae45faad0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed.ES256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a227752684b58393334424634543345663153324831706c61325a725751475046746877365356756d56494249222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a20396138624e596a4b436757724258552d66436c3161673d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a363616c67266373696758473045022025fcee945801b94e63d7c029e6f761654cf02e7100d5364a3b90e03daa6276fc022100eabcdf4ce19feb0980e829c3b6137079b18e42f43ce5c3c573b83368794f354c637835638159022530820221308201c8a00302010202110088c220f83c8ef1feafe94deae45faad0300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d03010703420004a91ba4389409dd38a428141940ca8feb1ac0d7b4350558104a3777a49322f3798440f378b3398ab2d3bb7bf91322c92eb23556f59ad0a836fec4c7663b0e4dc3a360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e04160414a589ba72d060842ab11f74fb246bdedab16f9b9b301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d040302034700304402201726b9d85ecd8a5ed51163722ca3a20886fd9b242a0aa0453d442116075defd502207ef471e530ac87961a88a7f0d0c17b091ffc6b9238d30f79f635b417be5910e768617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54d00000000876ca4f52071c3e9b25509ef2cdf7ed60020c9a6f5b3462d02873fea0c56862234f99f081728084e511bb7760201a89054a5a50102032620012158201cf27f25da591208a4239c2e324f104f585525479a29edeedd830f48e77aeae522582059e4b7da6c0106e206ce390c93ab98a15a5ec3887e57f0cc2bece803b920c423'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⓪">Authentication</a>:</p>
+<pre class="example highlight" id="example-c7bc46cc"><a class="self-link" href="#example-c7bc46cc"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'b1106fa46a57bef1781511c0557dc898a03413d5f0f17d244630c194c7e1adb5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'75'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='packed.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'019330c8cc486c3f3eba0b85369eabf1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0b', info='packed.ES256', L=16)</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'46'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0c', info='packed.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50d00000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a2273524276704770587676463446524841565833496d4b4130453958773858306b526a44426c4d6668726255222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a20415a4d77794d78496244382d756775464e70367238513d3d227d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'30460221009d8d54895393894d37b9fa7bdfbcff05403de3cf0d6443ffb394fa239f101579022100c8871288f19c6c48a3b64c09d39868c12d16ed80ea4c5d8890288975c0272f50'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.7" id="sctn-test-vectors-packed-es384"><span class="secno">16.1.7. </span><span class="content">Packed Attestation with ES384 Credential</span><a class="self-link" href="#sctn-test-vectors-packed-es384"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⑤">Registration</a>:</p>
+<pre class="example highlight" id="example-19aee6dd"><a class="self-link" href="#example-19aee6dd"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'567b030b3e186bc1d169dd45b79f9e0d86f1fd63474da3eade5bdb8db379a0c3'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed.ES384', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'271e37d309c558c0f35222b37abba7500377d68e179e4c74b0cb558551b2e5276b47b90a317ca8ebbe1a12c93c2d5dd9'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed.ES384', L=48)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'32'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed.ES384', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'e950dcda3bdae1d087cda380a897848b'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed.ES384', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'953ae2dd9f28b1a1d5802c83e1f65833bb9769a08de82d812bc27c13fc6f06a9'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed.ES384', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'db'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed.ES384', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'8d979fbb6e49c4eeb5925a2bca0fcdb023d3fb90bcadce8391da9da4ed2aee9a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed.ES384', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'3d0a5588bb87ebb1d4cee4a1807c1b7c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed.ES384', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22566e7344437a3459613848526164314674352d65445962785f574e4854615071336c76626a624e356f4d4d222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a363616c67266373696758473045022100c56ecc970b7843833e0f461fde26233f61eb395161d481558c08b9c6ed61675b022029f5e05033705cd0f9b0a07e149468ec308a4f84906409efdceb1da20a7518d6637835638159022530820221308201c7a00302010202103d0a5588bb87ebb1d4cee4a1807c1b7c300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d0301070342000417e5cc91d676d370e36aa7de40c25aacb45a3845f13d2932088ece2270b9b431241c219c22d0c256c9438ade00f2c05e62f8ef906b9b997ae9f3c460c2db66f5a360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e04160414c7c8dd95382a2230e4c0dd3664338fa908169a9c301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d0403020348003045022054068cc9ae038937b7c468c307edb9c6927ffdeb6a20070c483eb40330f99f10022100cf41953919c3c04693d6b1f42a613753f204e70e85fc6e9b17036170b83596e068617574684461746158c5bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b55900000000e950dcda3bdae1d087cda380a897848b0020953ae2dd9f28b1a1d5802c83e1f65833bb9769a08de82d812bc27c13fc6f06a9a5010203382220022158304866bd8b01da789e9eb806e5eab05ae5a638542296ab057a2f1bbce9b58f8a08b9171390b58a37ac7fffc2c5f45857da2258302a0b024c7f4b72072a1f96bd30a7261aae9571dd39870eb29e55c0941c6b08e89629a1ea1216aa64ce57c2807bf3901a'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥①">Authentication</a>:</p>
+<pre class="example highlight" id="example-ad5defce"><a class="self-link" href="#example-ad5defce"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'ff41c3d25dbd8966fb61e28ef5e47041e137ed268520412d76202ba0ad2d1453'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed.ES384', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'0c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed.ES384', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'af'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='packed.ES384', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50d00000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a225f304844306c32396957623759654b4f39655277516545333753614649454574646941726f4b307446464d222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3065023100e4efbb46745ed00e67c4d51ab2bacab2af62ffa8b7c5fecec6d7d9bf2582275034a713a3dd731685eee81adfaf6aa63f0230161655353f07e018a3c2539f8de7c8c4cf88d4c32d2be29fe4e76fa096ecc9458bbfe0895d57129ab324130e6f0692db'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.8" id="sctn-test-vectors-packed-es512"><span class="secno">16.1.8. </span><span class="content">Packed Attestation with ES512 Credential</span><a class="self-link" href="#sctn-test-vectors-packed-es512"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⑥">Registration</a>:</p>
+<pre class="example highlight" id="example-f9adc676"><a class="self-link" href="#example-f9adc676"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'4ee220cd92b07e11451cb4c201c5755bd879848e492a9b12d79135c62764dc2fd28ead4808cafe5ad1de8fa9e08d4a8eeafea4dfb333877b02bc503f475d3b0c1394a7683baaf4f2477829f7b8cf750948985558748c073068396fcfdcd3f245bf2038e6bb38d7532768aad13be8c118f727722e7426139041e9caca503884c5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed.ES512', L=128)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'f11120594f6a4944ac3ba59adbbc5b85016895b649f4cc949a610f4b48be47b318850bacb105f747647bba8852b6b8e52a0b3679f1bbbdfe18c99409bcb644fa45'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed.ES512', L=65)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'6d'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed.ES512', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'a37a958ce2f6b535a6e06c64cc8fd082'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed.ES512', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'39d8ce6a3cf61025775083a738e5c254'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed.ES512', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'d17d5af7e3f37c56622a67c8462c9e1c6336dfccb8b61d359dc47378dba58ce4'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed.ES512', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'cf'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed.ES512', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'ffbc89d5f75994f52dc5e7538ee269402d26995d40c16fb713473e34fca98be4'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed.ES512', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'8a128b7ebe52b993835779e6d9b81355'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed.ES512', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22547549677a5a4b7766684646484c544341635631573968356849354a4b707353313545317869646b33435f536a713149434d722d577448656a366e676a55714f3676366b33374d7a683373437646415f5231303744424f5570326737717654795233677039376a5064516c496d465659644977484d47673562385f63305f4a46767941343572733431314d6e614b72524f2d6a424750636e636935304a684f5151656e4b796c4134684d55222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a206f3371566a4f4c327454576d3447786b7a495f5167673d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a363616c67266373696758483046022100c48fcbd826bbc79680802026688d41ab6da8c3a1d22ab6cecf36c8d7695d22500221008767dfe591277e973078d5692c8c35cf9d579792822e7145c96a0ac4515df5b0637835638159022730820223308201c8a0030201020211008a128b7ebe52b993835779e6d9b81355300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d03010703420004940b68885291536e2f7c60c05acfb252e7eebcf4304425dd93ab7b1962f20492bf18dc0f12862599e81fb764ac92151f9a78fcbb35d7a26c8c52949b18133c06a360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e041604143ffad863abcd3dc5717b8a252189f41af97e7f31301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d0403020349003046022100832c8b64c4f0188bd32e1bec63e13301cdc03165d3ef840d1f3dabb9a5719f83022100add57a9d5bedec98f29222dfc97ea795d055ee13a02a153d02be9ce00aedeb9168617574684461746158e9bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54d0000000039d8ce6a3cf61025775083a738e5c2540020d17d5af7e3f37c56622a67c8462c9e1c6336dfccb8b61d359dc47378dba58ce4a5010203382320032158420083240a2c3ad21a3dc0a6daa3d8bc05a46d7cd9825ba010ae2a22686c2d6d663d7d5f678987fb1e767542e63dc197ae915e25f8ee284651af29066910a2cc083f50225842017337df47ab5cce5d716ef8caffa97a3012689b1f326ea6c43a1ba9596c72f71f0122390143552b42be772b4c35ffb961220c743b486a601ea4cb6d5412f5b078d3'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥②">Authentication</a>:</p>
+<pre class="example highlight" id="example-9612219e"><a class="self-link" href="#example-9612219e"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'08d3190c6dcb3d4f0cb659a0333bf5ea124ddf36a0cd33d5204b0d7a22a8cc26f2e4f169d200285c77b3fb22e0f1c7f49a87d4be2d25e92d797808ddaaa9b5715efd3a6ada9339d3052a687dbc5d2f8c871b0451e0691f57ad138541b7b72e7aa8933729ec1c664bf2e4dedae1616d08ecefa80a2a53b103663ce5a881048829'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed.ES512', L=128)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'ac'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='packed.ES512', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'52'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0b', info='packed.ES512', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b51900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22434e4d5a4447334c5055384d746c6d674d7a763136684a4e337a61677a5450564945734e65694b6f7a436279355046703067416f5848657a2d794c67386366306d6f66557669306c3653313565416a6471716d31635637394f6d72616b7a6e544253706f666278644c3479484777525234476b66563630546855473374793536714a4d334b6577635a6b7679354e376134574674434f7a7671416f71553745445a6a7a6c7149454569436b222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3081870242009bda02fe384e77bcb9fb42b07c395b7a53ec9d9616dd0308ab8495c2141c8364c7d16e212a4a4fb8e3987ff6c99eafd64d8484fd28c3fc7968f658a9033d1bb1b802416383e9f3ee20c691b66620299fef36bea2df4d39c92b2ead92f58e7b79ab0d9864d2ebf3b0dcc66ea13234492ccee6e9d421db43c959bcb94c162dc9494136c9f6'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.9" id="sctn-test-vectors-packed-rs256"><span class="secno">16.1.9. </span><span class="content">Packed Attestation with RS256 Credential</span><a class="self-link" href="#sctn-test-vectors-packed-rs256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⑦">Registration</a>:</p>
+<pre class="example highlight" id="example-7d0a9777"><a class="self-link" href="#example-7d0a9777"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'bea8f0770009bd57f2c0df6fea9f743a27e4b61bbe923c862c7aad7a9fc8e4a6'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed.RS256', L=32)</c->
+
+<c- c1>; The two smallest Mersenne primes 2^p - 1 where p >= 1024</c->
+<c- nc>private_key_p</c-> <c- o>=</c-> <c- mi>2</c-><c- o>^</c-><c- mi>1279</c-> - <c- mi>1</c-> <c- o>=</c-> h<c- t>'7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'</c->
+<c- nc>private_key_q</c-> <c- o>=</c-> <c- mi>2</c-><c- o>^</c-><c- mi>2203</c-> - <c- mi>1</c-> <c- o>=</c-> h<c- t>'07ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'1c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed.RS256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'428f8878298b9862a36ad8c7527bfef2'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed.RS256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'992a18acc83f67533600c1138a4b4c4bd236de13629cf025ed17cb00b00b74df'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed.RS256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'7e'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed.RS256', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'08a1322d5aa5b5b40cd67c2cc30b038e7921d7888c84c342d50d79f0c5fc3464'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed.RS256', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'1f6fb7a5ece81b45896b983a995da5f3'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed.RS256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a2276716a776477414a76566679774e3976367039304f69666b7468752d6b6a79474c48717465705f49354b59222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a363616c672663736967584730450221008b8c5c6ea8c142c032e0be69e1353d44461c5c9109941cdda951b976eb95b6b302204d52f406c19e254b3ff9589bd18070fb055ac8db12fdd0a6734bea9d7168e900637835638159022630820222308201c7a00302010202101f6fb7a5ece81b45896b983a995da5f3300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d03010703420004b7b36b7542a11120b443c794d0c99fdc25a06b76586413d81e086163ef6fe147a557afc34e2861d9057d6d465d4705a0310550bdeeb5f35ee35b9425ab859981a360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e04160414fb37b647bccfb9e54d989eaaacc1633868703fb3301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d0403020349003046022100b86bc129d92afca7d9869a39f70f139a305b4073a39eb654d81424bed5757d91022100cf9f7c60cab7c4a7d3e7f0020f281a93d4fd0a9f95121b989f56932a68885fba68617574684461746159021bbfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b55d00000000428f8878298b9862a36ad8c7527bfef20020992a18acc83f67533600c1138a4b4c4bd236de13629cf025ed17cb00b00b74dfa4010303390100205901b403fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012143010001'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥③">Authentication</a>:</p>
+<pre class="example highlight" id="example-b9f42f2f"><a class="self-link" href="#example-b9f42f2f"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'295f59f5fa8fe62c5aca9e27626c78c8da376ae6d8cd2dd29aebad601e1bc4c5'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed.RS256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'0e'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed.RS256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'ba'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed.RS256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b51900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a224b56395a39667150356978617970346e596d7834794e6f33617562597a5333536d75757459423462784d55222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'01063d52d7c39b4d432fc7063c5d93e582bdcb16889cd71f888d67d880ea730a428498d3bc8e1ee11f2b1ecbe6c292b118c55ffaaddefa8cad0a54dd137c51f1eec673f1bb6c4d1789d6826a222b22d0f585fc901fdc933212e579d199b89d672aa44891333e6a1355536025e82b25590256c3538229b55737083b2f6b9377e49e2472f11952f79fdd0da180b5ffd901b4049a8f081bb40711bef76c62aed943571f2d0575304cb549d68d8892f95086a30f93716aee818f8dc06e96c0d5e0ed4cfa9fd8773d90464b68cf140f7986666ff9c9e3302acd0535d60d769f465e2ab57ef8aabc89fccfef7ba32a64154a8b3d26be2298f470b8cc5377dbe3dfd4b0b45f8f01e63bde6cfc76b62771f9b70aa27cf40152cad93aa5acd784fd4b90f676e2ea828d0bf2400aebbaae4153e5838f537f88b6228346782a93a899be66ec77de45b3efcf311da6321c92e6b0cd11bfe653bf3e98cee8e341f02d67dbb6f9c98d9e8178090cfb5b70fbc6d541599ac794ae2f1d4de1286ec8de8c2daf7b1d15c8438e90d924df5c19045220a4c8438c1b979bbe016cf3d0eeec23c3999d4882cc645b776de930756612cdc6dd398160ff02a6'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.10" id="sctn-test-vectors-packed-ed25519"><span class="secno">16.1.10. </span><span class="content">Packed Attestation with Ed25519 Credential</span><a class="self-link" href="#sctn-test-vectors-packed-ed25519"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⑧">Registration</a>:</p>
+<pre class="example highlight" id="example-f0be116c"><a class="self-link" href="#example-f0be116c"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'560c73a09ce7a1586d61c1d6e41fef149be523e220fc9f385d38ab23702ebf1b'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='packed.Ed25519', L=32)</c->
+
+<c- nc>private_key</c-> <c- o>=</c-> h<c- t>'c87fce9e9cd283d272a2418d9683366f83661e458ad4451f0f1c95cb83b0f0a8'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='packed.Ed25519', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'41'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='packed.Ed25519', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'db7587e24b9187edb77933754331e443'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='packed.Ed25519', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'164009ea09faae7c397bc3e2ad0e7ec0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='packed.Ed25519', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'c6cffa01b7fda368a7e0b29c1384a719820246bca894dd12914708743af0cecd'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='packed.Ed25519', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'e8'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='packed.Ed25519', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'673ee7fd94405de523fd84a088ab082d75b7fceef02a301e2bca0a28537cf243'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='packed.Ed25519', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'6e391f23f57150dc7a12dad18f2b43ad'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='packed.Ed25519', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a225667787a6f4a7a6e6f5668745963485735425f76464a766c492d49675f4a38345854697249334175767873222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a2032335748346b7552682d323365544e31517a486b51773d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74667061636b65646761747453746d74a363616c672663736967584730450220730a54d4f76cb1f2b7dd4a5a6eee3374e3c8a60fb3c4daa527c9277e365b64aa0221008b31a04a28cc4148b14c42a916548ee7f430bc7629295b42ee93e5d1aaba8ee6637835638159022530820221308201c7a00302010202106e391f23f57150dc7a12dad18f2b43ad300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d03010703420004fb96a581a0b36742a8c45d6ffb5af1ef155524b50339445ec1109874045e0087db77edef91f3dc949927470d84b01627087b72c86b7c9d02e1389cba680ffc36a360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e04160414ef2ce1a86caba85121130a16e8ce82a75d5a6653301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d0403020348003045022100ad4fa628cffba5a642a562cbfefe63efecce26d90c80114114d1745383e12f01022028af87ba3b0ff868a34b9458bc6973b27380a328dd87b7436651ffa823280bca6861757468446174615881bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54900000000164009ea09faae7c397bc3e2ad0e7ec00020c6cffa01b7fda368a7e0b29c1384a719820246bca894dd12914708743af0cecda401010327200621582089f81eba4a1f510cb243ff7fb9e9cf899bf627e49ce1ac3c3eae8adb2a8d7d7b'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥④">Authentication</a>:</p>
+<pre class="example highlight" id="example-7560c61b"><a class="self-link" href="#example-7560c61b"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'3790da8b2b72ee8ce19761787ad38cbfaa697eb3ca013a1342988756b98785ab'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='packed.Ed25519', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'de'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='packed.Ed25519', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'18'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0b', info='packed.Ed25519', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b51900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a224e35446169797479376f7a686c32463465744f4d763670706672504b41546f545170694856726d48686173222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'4c873571377ac019f257d6bf07249f63ac2487483c51bc511ce0f0e3266c840cb07a09cdc445a2f963d8603a9f0f6cf9ce709d7fc6a96c7c51ea08d33776010c'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.11" id="sctn-test-vectors-tpm-es256"><span class="secno">16.1.11. </span><span class="content">TPM Attestation with ES256 Credential</span><a class="self-link" href="#sctn-test-vectors-tpm-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③⑨">Registration</a>:</p>
+<pre class="example highlight" id="example-dfad2d1f"><a class="self-link" href="#example-dfad2d1f"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'cfc82cdf1ceee876120aa88f0364f0910193460cfb97a317b2fe090694f9a299'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='tpm.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'80c60805e564f6d33e7abdff9d32e3db09a6219fe378a268d23107191b18e39f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='tpm.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'84'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='tpm.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'4b92a377fc5f6107c4c85c190adbfd99'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='tpm.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'ec27bec7521c894bbb821105ea3724c90e770cf1fa354157ef18d0f18f78bea9'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='tpm.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'af'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='tpm.ES256', L=1)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'6210f09e0ce7593e851a880a4bdde2d2192afeac46104abce1a890a5a71cf0c6'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='tpm.ES256', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'311fc42da0ab10c43a9b1bf3a75e34e2'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='tpm.ES256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a227a38677333787a753648595343716950413254776b51475452677a376c364d587376344a427054356f706b222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d746374706d6761747453746d74a663616c67266373696758463044022066e5826a652091030fd444e33c3eca2bc6dc548cf3045013addb38aa6457a21002203f3a5c95c9e707d0e555041bcc8698ee4ebc04e26cc8bae459705471789851766376657263322e30637835638159023a30820236308201dca0030201020210311fc42da0ab10c43a9b1bf3a75e34e2300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a30003059301306072a8648ce3d020106082a8648ce3d03010703420004c54e3f109094f60d7699b7db5d838569ffd1f3e1c9e897cd9eb40063f9402e3e9937e936cf1fcd5eb743ff443c97ab2edcd7c8e0e6cf6cfd413b8ab19fffa769a381d33081d0300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e041604145f546cb6973d4981e80fcdc7463859f5879680e4301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e30100603551d250409300706056781050803305e0603551d110101ff04543052a450304e314c3014060567810502010c0b69643a30303030303030303014060567810502030c0b69643a3030303030303030301e060567810502020c15576562417574686e207465737420766563746f7273300a06082a8648ce3d0403020348003045022063c9a2797b8066f1db34dd609f1ab6695607e7a98e9ff8090a68853c9a9fc949022100a55831a39f5b8a2aa9a68837829cabf43fea2a5cea4859ae851cac78e6ac3e97677075624172656158560023000b0004000000000010001000030010002041202698c9d9753fb4bb3f27cd09fe6b8afdb76438ee2ae54d7c9dade10d864b0020d8735115cdb330a63ea1d6e43d5000f4bd56f99bce83ee1d73301fc270116d076863657274496e666f5869ff544347801700000020277d0e05579dd013215a62273f7f3a3e7e191ead2654a3036d75a5a3ee37a6b0000000000000000011111111222222223300000000000000000022000b9c42d8aad5939331b9af3711af179f17123178098c9a7d0ca89fcd1fc800f3c7000068617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54d000000004b92a377fc5f6107c4c85c190adbfd990020ec27bec7521c894bbb821105ea3724c90e770cf1fa354157ef18d0f18f78bea9a501020326200121582041202698c9d9753fb4bb3f27cd09fe6b8afdb76438ee2ae54d7c9dade10d864b225820d8735115cdb330a63ea1d6e43d5000f4bd56f99bce83ee1d73301fc270116d07'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⑤">Authentication</a>:</p>
+<pre class="example highlight" id="example-688c068a"><a class="self-link" href="#example-688c068a"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'00093b66c21d5b5e89f7a07082118907ea3e502d343b314b8c5a54d62db202fb'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='tpm.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'86'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='tpm.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'87'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='tpm.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50d00000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a2241416b375a7349645731364a393642776768474a422d6f2d554330304f7a464c6a46705531693279417673222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3045022060dc76b1607ec716c6e5eba8d056695ed6bc47b2e3d7a729c34e759e3ab66aa0022100d010a9e8fddcb64c439dfdca628ddb33cf245d567d157d9f66f942601bed9b38'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.12" id="sctn-test-vectors-android-key-es256"><span class="secno">16.1.12. </span><span class="content">Android Key Attestation with ES256 Credential</span><a class="self-link" href="#sctn-test-vectors-android-key-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④⓪">Registration</a>:</p>
+<pre class="example highlight" id="example-923e2828"><a class="self-link" href="#example-923e2828"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'3de1f0b7365dccde3ff0cbf25e26ffa7baff87ef106c80fc865dc402d9960050'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='android-key.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'d4328d911acb0ebcc42aad29b29ffb55d5bc31d8af7ca9a16703d56c21abc7b4'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='android-key.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'73'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='android-key.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'555d5c42e476a8b33f6a63dfa07ccbd2'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='android-key.ES256', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'ade9705e1ce7085b899a540d02199bf8'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='android-key.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'0a4729519788b6ed8a2d772b494e186244d8c798c052960dbc8c10c915176795'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='android-key.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'1e'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='android-key.ES256', L=1)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'1ff91f76b63f44812f998b250b0286bf'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='android-key.ES256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a2250654877747a5a647a4e345f384d76795869625f7037725f682d385162494438686c334541746d57414641222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a205656316351755232714c4d5f616d50666f487a4c30673d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d746b616e64726f69642d6b65796761747453746d74a363616c672663736967584630440220592bbc3c4c5f6158b52be1e085c92848986d7844245dfc9512e1a7e9ff7a2cd8022015bdd0852d3bd091e1c22da4211f4ccf0fdf4d912599d1c6630b1f310d3166f5637835638159026d3082026930820210a00302010202101ff91f76b63f44812f998b250b0286bf300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d0301070342000499169657036d089a2a9821a7d0063d341f1a4613389359636efab5f3cbf1accfdd91c55543176ea99b644406dd1dd63774b6af65ac759e06ff40b1c8ab02df6ba381a83081a5300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e041604141ac81e50641e8d1339ab9f7eb25f0cd5aac054b0301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e3045060a2b06010401d679020111043730350202012c0201000201000201000420b20e943e3a7544b3a438943b6d5655313a47ef1af34e00ff3261aeb9ed155817040030003000300a06082a8648ce3d040302034700304402206f4609c9ffc946c418cef04c64a0d07bcce78f329b99270b822f2a4d1e3b75330220093c8d18328f36ef157f296393bdc7721dd2bd67438ffeaa42f051a044b7457168617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b55d00000000ade9705e1ce7085b899a540d02199bf800200a4729519788b6ed8a2d772b494e186244d8c798c052960dbc8c10c915176795a501020326200121582099169657036d089a2a9821a7d0063d341f1a4613389359636efab5f3cbf1accf225820dd91c55543176ea99b644406dd1dd63774b6af65ac759e06ff40b1c8ab02df6b'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⑥">Authentication</a>:</p>
+<pre class="example highlight" id="example-08cfa423"><a class="self-link" href="#example-08cfa423"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'e4ee05ca9dbced74116540f24ed9adc62aae8507560522844ffa7eea14f7af86'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='android-key.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'43'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='android-key.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'ab127107eff182bc3230beb5f1dad29c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='android-key.ES256', L=16)</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'4a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0b', info='android-key.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22354f344679703238375851525a55447954746d74786971756851645742534b45545f702d36685433723459222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a2071784a78422d5f78677277794d4c3631386472536e413d3d227d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'304502202060107d953b286aa1bf35e3e8c78b383fddab5591b2db17ffb23ed83fe7df20022100a99be0297cb0d9d38aa96f30b760a4e0749dab385acd2a51d0560caae570d225'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.13" id="sctn-test-vectors-apple-es256"><span class="secno">16.1.13. </span><span class="content">Apple Anonymous Attestation with ES256 Credential</span><a class="self-link" href="#sctn-test-vectors-apple-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④①">Registration</a>:</p>
+<pre class="example highlight" id="example-ab53d733"><a class="self-link" href="#example-ab53d733"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'f7f688213852007775009cf8c096fda89d60b9a9fb5a50dd81dd9898af5a0609'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='apple.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'de987bd9d43eeb44728ce0b14df11209dff931fb56b5b1948de4c0da1144ded0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='apple.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'5f'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='apple.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>extra_client_data</c-> <c- o>=</c-> h<c- t>'4e32cf9e939a5d052b14d71b1f6b5364'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='apple.ES256', L=16)</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'748210a20076616a733b2114336fc384'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='apple.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'9c4a5886af9283d9be3e9ec55978dedfdce2e3b365cab193ae850c16238fafb8'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='apple.ES256', L=32)</c->
+<c- c1>; auth_data_UV_BE_BS determines the UV, BE and BS bits of the authenticator data flags, but BS is set only if BE is</c->
+<c- nc>auth_data_UV_BE_BS</c-> <c- o>=</c-> h<c- t>'2a'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='apple.ES256', L=1)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'394275613d5310b81a29ce90f48b61c1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='apple.ES256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22395f61494954685341486431414a7a34774a6239714a316775616e37576c4464676432596d4b396142676b222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73652c22657874726144617461223a22636c69656e74446174614a534f4e206d617920626520657874656e6465642077697468206164646974696f6e616c206669656c647320696e20746865206675747572652c207375636820617320746869733a20546a4c506e704f6158515572464e6362483274545a413d3d227d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74656170706c656761747453746d74a1637835638159025c30820258308201fea0030201020210394275613d5310b81a29ce90f48b61c1300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d030107034200048a3d5b1b4c543a706bf6e4b00afedb3c930b690dd286934fe2911f779cc7761af728e1aa3b0ff66692192daa776b83ddf8e3340d2d9a0eabdfc324eb3e2f136ca38196308193300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e0416041412f1ce6c0ae39b403bfc9200317bc183a4e4d766301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e303306092a864886f76364080204263024a122042097851a1a98b69c0614b26a94b70ec3aa07c061f89dbee23fbee01b6c42d718b0300a06082a8648ce3d040302034800304502207d541a5553f38b93b78b26a9dca58e64a7f8fac15ca206ae3ea32497cda375fb0221009137c6b75e767ec08224b29a7f703db4b745686dcc8a26b66e793688866d064f68617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54900000000748210a20076616a733b2114336fc38400209c4a5886af9283d9be3e9ec55978dedfdce2e3b365cab193ae850c16238fafb8a50102032620012158208a3d5b1b4c543a706bf6e4b00afedb3c930b690dd286934fe2911f779cc7761a225820f728e1aa3b0ff66692192daa776b83ddf8e3340d2d9a0eabdfc324eb3e2f136c'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⑦">Authentication</a>:</p>
+<pre class="example highlight" id="example-42de76f9"><a class="self-link" href="#example-42de76f9"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'d3eb2964641e26fed023403a72dde093b19c4ba9008c3f9dd83fcfd347a66d05'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='apple.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'c2'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='apple.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'e2'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'0a', info='apple.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50900000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22302d73705a4751654a76375149304136637433676b37476353366b416a442d6432445f503030656d625155222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'3046022100ee35db795ce28044e1f8231d68b3d79a9882f7415aa35c1b5ac74d24251073c8022100dcc65691650a412d0ceef843710c09827acf26c7845bddac07eec95863e7fc4c'</c->
+</pre>
+   <h4 class="heading settled" data-level="16.1.14" id="sctn-test-vectors-fido-u2f-es256"><span class="secno">16.1.14. </span><span class="content">FIDO U2F Attestation with ES256 Credential</span><a class="self-link" href="#sctn-test-vectors-fido-u2f-es256"></a></h4>
+   <p><a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④②">Registration</a>:</p>
+<pre class="example highlight" id="example-4dea5449"><a class="self-link" href="#example-4dea5449"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'e074372990b9caa507a227dfc67b003780c45325380d1a90c20f81ed7d080c06'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'00', info='fido-u2f.ES256', L=32)</c->
+
+<c- nc>credential_private_key</c-> <c- o>=</c-> h<c- t>'51bd002938fa10b83683ac2a2032d0a7338c7f65a90228cfd1f61b81ec7288d0'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'01', info='fido-u2f.ES256', L=32)</c->
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'00'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'02', info='fido-u2f.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- nc>aaguid</c-> <c- o>=</c-> h<c- t>'afb3c2efc054df425013d5c88e79c3c1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'03', info='fido-u2f.ES256', L=16)</c->
+<c- nc>credential_id</c-> <c- o>=</c-> h<c- t>'a4ba6e2d2cfec43648d7d25c5ed5659bc18f2b781538527ebd492de03256bdf4'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'04', info='fido-u2f.ES256', L=32)</c->
+<c- nc>attestation_private_key</c-> <c- o>=</c-> h<c- t>'66fda477a2a99d14c5edd7c1041a297ba5f3375108b1d032b79429f42349ce33'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'05', info='fido-u2f.ES256', L=32)</c->
+<c- nc>attestation_cert_serial_number</c-> <c- o>=</c-> h<c- t>'04f66dc6542ea7719dea416d325a2401'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'06', info='fido-u2f.ES256', L=16)</c->
+
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e637265617465222c226368616c6c656e6765223a22344851334b5a4335797155486f696666786e73414e344445557955344452715177672d4237583049444159222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>attestationObject</c-> <c- o>=</c-> h<c- t>'a363666d74686669646f2d7532666761747453746d74a26373696758473045022100f41887a20063bb26867cb9751978accea5b81791a68f4f4dd6ea1fb6a5c086c302204e5e00aa3895777e6608f1f375f95450045da3da57a0e4fd451df35a31d2d98a637835638159022530820221308201c7a003020102021004f66dc6542ea7719dea416d325a2401300a06082a8648ce3d0403023062311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331253023060355040b0c1c41757468656e74696361746f72204174746573746174696f6e204341310b30090603550406130241413020170d3234303130313030303030305a180f33303234303130313030303030305a305f311e301c06035504030c15576562417574686e207465737420766563746f7273310c300a060355040a0c0357334331223020060355040b0c1941757468656e74696361746f72204174746573746174696f6e310b30090603550406130241413059301306072a8648ce3d020106082a8648ce3d0301070342000456fffa7093dede46aefeefb6e520c7ccc78967636e2f92582ba71455f64e93932dff3be4e0d4ef68e3e3b73aa087e26a0a0a30b02dc2aa2309db4c3a2fc936dea360305e300c0603551d130101ff04023000300e0603551d0f0101ff040403020780301d0603551d0e04160414420822eb1908b5cd3911017fbcad4641c05e05a3301f0603551d2304183016801445aff715b0dd786741fee996ebc16547a3931b1e300a06082a8648ce3d040302034800304502200d0b777f0a0b181ad2830275acc3150fd6092430bcd034fd77beb7bdf8c2d546022100d4864edd95daa3927080855df199f1717299b24a5eecefbd017455a9b934d8f668617574684461746158a4bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b54100000000afb3c2efc054df425013d5c88e79c3c10020a4ba6e2d2cfec43648d7d25c5ed5659bc18f2b781538527ebd492de03256bdf4a5010203262001215820b0d62de6b30f86f0bac7a9016951391c2e31849e2e64661cbd2b13cd7d5508ad225820503b0bda2a357a9a4b34475a28e65b660b4898a9e3e9bbf0820d43494297edd0'</c->
+</pre>
+   <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⑧">Authentication</a>:</p>
+<pre class="example highlight" id="example-6d58f3a0"><a class="self-link" href="#example-6d58f3a0"></a><c- nc>challenge</c-> <c- o>=</c-> h<c- t>'f90c612981d84f599438de1a500f76926e92cc84bef8e02c6e23553f00485435'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'07', info='fido-u2f.ES256', L=32)</c->
+
+<c- nc>client_data_gen_flags</c-> <c- o>=</c-> h<c- t>'2c'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'08', info='fido-u2f.ES256', L=1)</c->
+<c- c1>; extra_client_data is included iff bit 0x01 of client_data_gen_flags is 1</c->
+<c- c1>; auth_data_UV_BS sets the UV and BS bits of the authenticator data flags, but BS is set only if BE was set in the registration</c->
+<c- nc>auth_data_UV_BS</c-> <c- o>=</c-> h<c- t>'d1'</c->   <c- c1>; Derived by: HKDF-SHA-256(IKM='WebAuthn test vectors', salt=h'09', info='fido-u2f.ES256', L=1)</c->
+
+<c- nc>authenticatorData</c-> <c- o>=</c-> h<c- t>'bfabc37432958b063360d3ad6461c9c4735ae7f8edd46592a5e0f01452b2e4b50100000000'</c->
+<c- nc>clientDataJSON</c-> <c- o>=</c-> h<c- t>'7b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a222d5178684b59485954316d554f4e3461554139326b6d36537a49532d2d4f417362694e5650774249564455222c226f726967696e223a2268747470733a2f2f6578616d706c652e6f7267222c2263726f73734f726967696e223a66616c73657d'</c->
+<c- nc>signature</c-> <c- o>=</c-> h<c- t>'304402206172459958fea907b7292b92f555034bfd884895f287a76200c1ba287239137002204727b166147e26a21bbc2921d192ebfed569b79438538e5c128b5e28e6926dd7'</c->
+</pre>
+   <h3 class="heading settled" data-level="16.2" id="test-vectors-extensions"><span class="secno">16.2. </span><span class="content">Test Vectors for <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⑥">WebAuthn Extensions</a></span><a class="self-link" href="#test-vectors-extensions"></a></h3>
+   <p>This section lists example values for <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⑦">WebAuthn extensions</a>.</p>
+   <h4 class="heading settled" data-level="16.2.1" id="test-vectors-extensions-prf"><span class="secno">16.2.1. </span><span class="content">Pseudo-random function extension (prf)</span><a class="self-link" href="#test-vectors-extensions-prf"></a></h4>
+   <p>This section lists example values for the pseudo-random function (<a data-link-type="dfn" href="#prf" id="ref-for-prf②">prf</a>) extension.</p>
+   <p>Because the <a data-link-type="dfn" href="#prf" id="ref-for-prf③">prf</a> extension integrates with the CTAP2 <code>hmac-secret</code> extension <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>,
+the examples are divided into two sections:
+example inputs and outputs for the WebAuthn <a data-link-type="dfn" href="#prf" id="ref-for-prf④">prf</a> extension, relevant to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑤">WebAuthn Clients</a> and <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑧">WebAuthn Relying Parties</a>;
+and example mappings between the WebAuthn <a data-link-type="dfn" href="#prf" id="ref-for-prf⑤">prf</a> extension and the CTAP2 <code>hmac-secret</code> extension,
+relevant to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑥">WebAuthn Clients</a> and <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②①">WebAuthn Authenticator</a>.</p>
+   <h5 class="heading settled" data-level="16.2.1.1" id="test-vectors-extensions-prf-webauthn"><span class="secno">16.2.1.1. </span><span class="content">Web Authentication API</span><a class="self-link" href="#test-vectors-extensions-prf-webauthn"></a></h5>
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑦">WebAuthn Client</a> implementations of and <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑨">WebAuthn Relying Party</a> usage of the <a data-link-type="dfn" href="#prf" id="ref-for-prf⑥">prf</a> extension.
+The examples are not exhaustive.</p>
+   <ul>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled③">enabled</a></code> output is always present during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④③">registration ceremonies</a>,
+and never present during <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥⑨">authentication ceremonies</a>:</p>
+<pre class="example highlight" id="example-5584eab4"><a class="self-link" href="#example-5584eab4"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.create():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>false</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑤">results</a></code> output may be present
+during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④④">registration ceremonies</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦⓪">authentication ceremonies</a> if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑨">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑥">evalByCredential</a></code> input is present:</p>
+<pre class="example highlight" id="example-70210d97"><a class="self-link" href="#example-70210d97"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> eval<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>])</c-> <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.create():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>false</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-><c- p>,</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑥">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second④">second</a></code></code> output
+is present if and only if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑦">results</a></code> output is present
+and the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑤">second</a></code></code> input was present in the chosen PRF inputs:</p>
+<pre class="example highlight" id="example-abd7c645"><a class="self-link" href="#example-abd7c645"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    eval<c- o>:</c-> <c- p>{</c->
+      first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>]),</c->
+      second<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>5</c-><c- p>,</c-> <c- mf>6</c-><c- p>,</c-> <c- mf>7</c-><c- p>,</c-> <c- mf>8</c-><c- p>]),</c->
+    <c- p>},</c->
+    evalByCredential<c- o>:</c-> <c- p>{</c->
+      <c- u>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE"</c-><c- o>:</c-> <c- p>{</c->
+        first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>]),</c->
+      <c- p>}</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get() if credential "e02eZ9lP..." was used:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get() if a different credential was used:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer<c- p>,</c-> second<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first②">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑥">second</a></code> outputs
+may be any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑥">BufferSource</a></code> type.
+Equal <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first③">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑦">second</a></code> inputs
+result in equal <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first④">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑧">second</a></code> outputs:</p>
+<pre class="example highlight" id="example-b1f3f15a"><a class="self-link" href="#example-b1f3f15a"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    evalByCredential<c- o>:</c-> <c- p>{</c->
+      <c- u>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE"</c-><c- o>:</c-> <c- p>{</c->
+        first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>]),</c->
+        second<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>])</c->
+      <c- p>}</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    results<c- o>:</c-> <c- p>{</c->
+      first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mh>0xc4</c-><c- p>,</c-> <c- mh>0x17</c-><c- p>,</c-> <c- mh>0x2e</c-><c- p>,</c-> <c- mh>0x98</c-><c- p>,</c-> <c- mh>0x2e</c-><c- p>,</c-> <c- mh>0x90</c-><c- p>,</c-> <c- mh>0x97</c-><c- p>,</c-> <c- mh>0xc3</c-><c- p>,</c-> <c- mh>0x9a</c-><c- p>,</c-> <c- mh>0x6c</c-><c- p>,</c-> <c- mh>0x0c</c-><c- p>,</c-> <c- mh>0xb7</c-><c- p>,</c-> <c- mh>0x20</c-><c- p>,</c-> <c- mh>0xcb</c-><c- p>,</c-> <c- mh>0x37</c-><c- p>,</c-> <c- mh>0x5b</c-><c- p>,</c-> <c- mh>0x92</c-><c- p>,</c-> <c- mh>0xe3</c-><c- p>,</c-> <c- mh>0xfc</c-><c- p>,</c-> <c- mh>0xad</c-><c- p>,</c-> <c- mh>0x15</c-><c- p>,</c-> <c- mh>0x4a</c-><c- p>,</c-> <c- mh>0x63</c-><c- p>,</c-> <c- mh>0xe4</c-><c- p>,</c-> <c- mh>0x3a</c-><c- p>,</c-> <c- mh>0x93</c-><c- p>,</c-> <c- mh>0xf1</c-><c- p>,</c-> <c- mh>0x09</c-><c- p>,</c-> <c- mh>0x6b</c-><c- p>,</c-> <c- mh>0x1e</c-><c- p>,</c-> <c- mh>0x19</c-><c- p>,</c-> <c- mh>0x73</c-><c- p>]),</c->
+      second<c- o>:</c-> <c- ow>new</c-> Uint32Array<c- p>([</c-><c- mh>0x982e17c4</c-><c- p>,</c-> <c- mh>0xc397902e</c-><c- p>,</c-> <c- mh>0xb70c6c9a</c-><c- p>,</c-> <c- mh>0x5b37cb20</c-><c- p>,</c-> <c- mh>0xadfce392</c-><c- p>,</c-> <c- mh>0xe4634a15</c-><c- p>,</c-> <c- mh>0x09f1933a</c-><c- p>,</c-> <c- mh>0x73191e6b</c-><c- p>]),</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+</pre>
+   </ul>
+   <p>Pseudo-random values used in this section were generated as follows:</p>
+   <ul>
+    <li data-md>
+     <p><code>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE" = Base64Url(SHA-256(UTF-8("WebAuthn PRF test vectors") || 0x00))</code></p>
+    <li data-md>
+     <p><code>h'c4172e982e9097c39a6c0cb720cb375b92e3fcad154a63e43a93f1096b1e1973' = SHA-256(UTF-8("WebAuthn PRF test vectors") || 0x01)</code></p>
+   </ul>
+   <h5 class="heading settled" data-level="16.2.1.2" id="test-vectors-extensions-prf-ctap"><span class="secno">16.2.1.2. </span><span class="content">CTAP2 <code>hmac-secret</code> extension</span><a class="self-link" href="#test-vectors-extensions-prf-ctap"></a></h5>
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑧">WebAuthn Client</a> implementations
+of how the <a data-link-type="dfn" href="#prf" id="ref-for-prf⑦">prf</a> extension uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension.
+The examples are given in CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> notation.
+The examples are not exhaustive.</p>
+   <ul>
+    <li data-md>
+     <p>The following shared definitions are used in all subsequent examples:</p>
+<pre class="example highlight" id="example-ec79b3a4"><a class="self-link" href="#example-ec79b3a4"></a><c- c1>; Given input parameters:</c->
+<c- nc>platform_key_agreement_private_key</c-> <c- o>=</c-> <c- mh>0x0971bc7fb1be48270adcd3d9a5fc15d5fb0f335b3071ff36a54c007fa6c76514</c->
+<c- nc>authenticator_key_agreement_public_key</c-> <c- o>=</c-> <c- p>{</c->
+    <c- mi>1</c-><c- p>:</c-> <c- mi>2</c-><c- p>,</c->
+    <c- mi>3</c-><c- p>:</c-> <c- mi>-25</c-><c- p>,</c->
+    <c- mi>-1</c-><c- p>:</c-> <c- mi>1</c-><c- p>,</c->
+    <c- mi>-2</c-><c- p>:</c-> h<c- t>'a30522c2de402b561965c3cf949a1cab020c6f6ea36fcf7e911ac1a0f1515300'</c-><c- p>,</c->
+    <c- mi>-3</c-><c- p>:</c-> h<c- t>'9961a929abdb2f42e6566771887d41484d889e735e3248518a53112d2b915f00'</c-><c- p>,</c->
+<c- p>}</c->
+<c- nc>authenticator_cred_random</c-> <c- o>=</c-> h<c- t>'437e065e723a98b2f08f39d8baf7c53ecb3c363c5e5104bdaaf5d5ca2e028154'</c->
+</pre>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑤">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑨">second</a></code> inputs
+are mapped in the examples as <code>prf_eval_first</code> and <code>prf_eval_second</code>, respectively.
+The <code>prf_results_first</code> and <code>prf_results_second</code> values in the examples
+are mapped to the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑧">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑥">first</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑨">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second①⓪">second</a></code></code> outputs, respectively.</p>
+    <li data-md>
+     <p>Single input case using PIN protocol 2:</p>
+<pre class="example highlight" id="example-7688ee66"><a class="self-link" href="#example-7688ee66"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'0c63083de8170101d38bcf8bd72309568ddb4550867e23404b35d85712f7c20d8bc911ee23c06034cbc14290b9669bec07739053c5a416e313ef905c79955876'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'437e065e723a98b2f08f39d8baf7c53ebbb2ed3e746b87576fd81f95def5757cad24be18eaef892e97692e684e07da53'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'3bfaa48f7952330d63e35ff8cd5bca48d2a12823828915749287256ab146272f9fb437bf65691243c3f504bd7ea6d5e6'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+</pre>
+    <li data-md>
+     <p>Two input case using PIN protocol 2:</p>
+<pre class="example highlight" id="example-1a1f45ad"><a class="self-link" href="#example-1a1f45ad"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+<c- nc>prf_eval_second</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727303'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'0c63083de8170101d38bcf8bd72309568ddb4550867e23404b35d85712f7c20d8bc911ee23c06034cbc14290b9669bec07739053c5a416e313ef905c79955876'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt2</c-> <c- o>=</c-> h<c- t>'d68ac03329a10ee5e0ec834492bb9a96a0e547baf563bf78ccbe8789b22e776b'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'23dde5e3462daf36559b85c4ac5f9656aa9bfd81c1dc2bf8533c8b9f3882854786b4f500e25b4e3d81f7fc7c742362294d92926c883b3fae1a3673246464bf730446e1fa4698c432a9092477c5dde5e3'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output2</c-> <c- o>=</c-> h<c- t>'a62a8773b19cda90d7ed4ef72a80a804320dbd3997e2f663805ad1fd3293d50b'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'90ee52f739043bc17b3488a74306d7801debb5b61f18662c648a25b5b5678ede482cdaff99a537a44f064fcb10ce6e04dfd27619dc96a0daff8507e499296b1eecf0981f7c8518b277a7a3018f5ec6fb'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>prf_results_second</c-> <c- o>=</c-> h<c- t>'a62a8773b19cda90d7ed4ef72a80a804320dbd3997e2f663805ad1fd3293d50b'</c->
+</pre>
+    <li data-md>
+     <p>Single input case using PIN protocol 1:</p>
+<pre class="example highlight" id="example-1498bea6"><a class="self-link" href="#example-1498bea6"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'23e5ed7157c25892b77732fb9c8a107e3518800db2af4142f9f4adfacb771d39'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'ab8c878bb05d04700f077ed91845ec9c503c925cb12b327ddbeb4243c397f913'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'15d4e4f3f04109b492b575c1b38c28585b6719cf8d61304215108d939f37ccfb'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+</pre>
+   </ul>
+   <p>Inputs and pseudo-random values used in this section were generated as follows:</p>
+   <ul>
+    <li data-md>
+     <p><code>seed = UTF-8("WebAuthn PRF test vectors")</code></p>
+    <li data-md>
+     <p><code>prf_eval_first = seed || 0x02</code></p>
+    <li data-md>
+     <p><code>prf_eval_second = seed || 0x03</code></p>
+    <li data-md>
+     <p><code>platform_key_agreement_private_key = SHA-256(seed || 0x04)</code></p>
+    <li data-md>
+     <p><code>authenticator_key_agreement_public_key = P256-Public-Key(sk)</code> where <code>sk = SHA-256(seed || 0x05)</code></p>
+    <li data-md>
+     <p><code>authenticator_cred_random = SHA-256(seed || 0x06)</code></p>
+    <li data-md>
+     <p><code>iv</code> in single-input <code>salt_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x07)</code></p>
+    <li data-md>
+     <p><code>iv</code> in two-input <code>salt_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x08)</code></p>
+    <li data-md>
+     <p><code>iv</code> in single-input <code>output_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x09)</code></p>
+    <li data-md>
+     <p><code>iv</code> in two-input <code>output_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x0a)</code></p>
+   </ul>
+   <h2 class="heading settled" data-level="17" id="sctn-acknowledgements"><span class="secno">17. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
     We thank the following people for their reviews of, and contributions to, this specification:
 Yuriy Ackermann,
 James Barclay,
@@ -9082,6 +9750,7 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
 Wally Jones,
 Ian Kilpatrick,
 Axel Nennker,
+Zack Newman,
 Yoshikazu Nojima,
 Kimberly Paulhamus,
 Adam Powers,
@@ -9099,6 +9768,8 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
 Richard Barnes
 for their contributions as co-chairs of the <a href="https://www.w3.org/Webauthn/">Web Authentication Working Group</a>.</p>
    <p>We also thank
+Simone Onofri,
+Philippe Le Hégaret,
 Wendy Seltzer,
 Samuel Weiler,
 and
@@ -9110,15 +9781,17 @@ <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index
   <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="content">Terms defined by this specification</span><a class="self-link" href="#index-defined-here"></a></h3>
   <ul class="index">
    <li><a href="#aaguid">AAGUID</a><span>, in § 6</span>
-   <li>
-    aaguid
-    <ul>
-     <li><a href="#abstract-opdef-supplementalpubkeys-record-aaguid">abstract-op for supplementalPubKeys record</a><span>, in § 10.2.2.3</span>
-     <li><a href="#authdata-attestedcredentialdata-aaguid">dfn for authData/attestedCredentialData</a><span>, in § 6.5.1</span>
-    </ul>
+   <li><a href="#authdata-attestedcredentialdata-aaguid">aaguid</a><span>, in § 6.5.1</span>
    <li><a href="#add-credential">Add Credential</a><span>, in § 11.5</span>
    <li><a href="#add-virtual-authenticator">Add Virtual Authenticator</a><span>, in § 11.3</span>
    <li><a href="#dom-publickeycredentialparameters-alg">alg</a><span>, in § 5.3</span>
+   <li>
+    allAcceptedCredentialIds
+    <ul>
+     <li><a href="#signal-method-authenticator-actions-allacceptedcredentialids">dfn for signal method/authenticator actions</a><span>, in § 5.1.10.3</span>
+     <li><a href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids">dict-member for AllAcceptedCredentialsOptions</a><span>, in § 5.1.10</span>
+    </ul>
+   <li><a href="#dictdef-allacceptedcredentialsoptions">AllAcceptedCredentialsOptions</a><span>, in § 5.1.10</span>
    <li>
     allowCredentials
     <ul>
@@ -9143,13 +9816,13 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     </ul>
    <li><a href="#assertion">Assertion</a><span>, in § 4</span>
    <li><a href="#assertion-signature">assertion signature</a><span>, in § 6</span>
+   <li><a href="#abstract-opdef-asynchronous-rp-id-validation-algorithm">Asynchronous RP ID validation algorithm</a><span>, in § 5.1.10.1</span>
    <li><a href="#authdata-flags-at">AT</a><span>, in § 6.1</span>
    <li><a href="#attca">AttCA</a><span>, in § 6.5.3</span>
    <li><a href="#attestation">Attestation</a><span>, in § 4</span>
    <li>
     attestation
     <ul>
-     <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation">dict-member for AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-publickeycredentialcreationoptions-attestation">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
      <li><a href="#dom-publickeycredentialcreationoptionsjson-attestation">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
     </ul>
@@ -9162,7 +9835,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     attestationFormats
     <ul>
-     <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats">dict-member for AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-publickeycredentialcreationoptions-attestationformats">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
      <li><a href="#dom-publickeycredentialcreationoptionsjson-attestationformats">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
     </ul>
@@ -9186,7 +9858,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#attestation-type">attestation type</a><span>, in § 6.5</span>
    <li><a href="#attested-credential-data">Attested credential data</a><span>, in § 6.5.1</span>
    <li><a href="#authdata-attestedcredentialdata">attestedCredentialData</a><span>, in § 6.1</span>
-   <li><a href="#abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</a><span>, in § 10.2.2.3</span>
    <li><a href="#authentication">Authentication</a><span>, in § 4</span>
    <li><a href="#authentication-assertion">Authentication Assertion</a><span>, in § 4</span>
    <li><a href="#authentication-ceremony">Authentication Ceremony</a><span>, in § 4</span>
@@ -9200,11 +9871,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dictdef-authenticationextensionsprfinputs">AuthenticationExtensionsPRFInputs</a><span>, in § 10.1.4</span>
    <li><a href="#dictdef-authenticationextensionsprfoutputs">AuthenticationExtensionsPRFOutputs</a><span>, in § 10.1.4</span>
    <li><a href="#dictdef-authenticationextensionsprfvalues">AuthenticationExtensionsPRFValues</a><span>, in § 10.1.4</span>
-   <li><a href="#dictdef-authenticationextensionssupplementalpubkeysinputs">AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
-   <li><a href="#dictdef-authenticationextensionssupplementalpubkeysoutputs">AuthenticationExtensionsSupplementalPubKeysOutputs</a><span>, in § 10.2.2.2</span>
    <li><a href="#authentication-factor-capability">Authentication Factor Capability</a><span>, in § 6.2.3</span>
    <li><a href="#dictdef-authenticationresponsejson">AuthenticationResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#authenticator">Authenticator</a><span>, in § 4</span>
+   <li><a href="#signal-method-authenticator-actions">authenticator actions</a><span>, in § 5.1.10</span>
    <li><a href="#authenticatorassertionresponse">AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
    <li><a href="#dictdef-authenticatorassertionresponsejson">AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#enumdef-authenticatorattachment">AuthenticatorAttachment</a><span>, in § 5.4.5</span>
@@ -9232,12 +9902,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#authenticator-data-for-the-attestation">authenticator data for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#assertioncreationdata-authenticatordataresult">authenticatorDataResult</a><span>, in § 5.1.4.1</span>
-   <li>
-    authenticatorDisplayName
-    <ul>
-     <li><a href="#abstract-opdef-credential-record-authenticatordisplayname">abstract-op for credential record</a><span>, in § 4</span>
-     <li><a href="#dom-credentialpropertiesoutput-authenticatordisplayname">dict-member for CredentialPropertiesOutput</a><span>, in § 10.1.3</span>
-    </ul>
    <li><a href="#authenticator-extension">authenticator extension</a><span>, in § 9</span>
    <li><a href="#authenticator-extension-capabilities">Authenticator Extension Capabilities</a><span>, in § 11.1.1</span>
    <li><a href="#authenticator-extension-input">authenticator extension input</a><span>, in § 9.3</span>
@@ -9309,9 +9973,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#assertioncreationdata-clientdatajsonresult">dfn for assertionCreationData</a><span>, in § 5.1.4.1</span>
      <li><a href="#credentialcreationdata-clientdatajsonresult">dfn for credentialCreationData</a><span>, in § 5.1.3</span>
     </ul>
-   <li><a href="#dom-publickeycredentialhints-client-device">"client-device"</a><span>, in § 5.8.8</span>
+   <li><a href="#dom-publickeycredentialhint-client-device">"client-device"</a><span>, in § 5.8.8</span>
    <li><a href="#client-device">Client Device</a><span>, in § 4</span>
-   <li><a href="#dom-publickeycredentialhints-client-device">client-device</a><span>, in § 5.8.8</span>
+   <li><a href="#dom-publickeycredentialhint-client-device">client-device</a><span>, in § 5.8.8</span>
    <li><a href="#client-extension">client extension</a><span>, in § 9</span>
    <li><a href="#client-extension-input">client extension input</a><span>, in § 9.3</span>
    <li><a href="#client-extension-output">client extension output</a><span>, in § 9.4</span>
@@ -9329,22 +9993,26 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#client-side">Client-Side</a><span>, in § 4</span>
    <li><a href="#client-side-credential-storage-modality">client-side credential storage modality</a><span>, in § 6.2.2</span>
    <li><a href="#client-side-discoverable-credential">Client-side discoverable Credential</a><span>, in § 4</span>
+   <li><a href="#credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a><span>, in § 10.1.3</span>
    <li><a href="#client-side-discoverable-public-key-credential-source">Client-side discoverable Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#dictdef-collectedclientdata">CollectedClientData</a><span>, in § 5.8.1</span>
-   <li><a href="#dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.4</span>
    <li><a href="#dom-clientcapability-conditionalcreate">"conditionalCreate"</a><span>, in § 5.8.7</span>
    <li><a href="#dom-clientcapability-conditionalcreate">conditionalCreate</a><span>, in § 5.8.7</span>
-   <li><a href="#dom-clientcapability-conditionalmediation">"conditionalMediation"</a><span>, in § 5.8.7</span>
-   <li><a href="#dom-clientcapability-conditionalmediation">conditionalMediation</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-conditionalget">"conditionalGet"</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-conditionalget">conditionalGet</a><span>, in § 5.8.7</span>
    <li><a href="#conforming-user-agent">Conforming User Agent</a><span>, in § 4</span>
    <li><a href="#contains">contains</a><span>, in § 4</span>
    <li><a href="#typedefdef-cosealgorithmidentifier">COSEAlgorithmIdentifier</a><span>, in § 5.8.5</span>
-   <li><a href="#abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a><span>, in § 10.2.2.3.2</span>
    <li><a href="#created-on">created on</a><span>, in § 4</span>
    <li><a href="#dom-publickeycredential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.3</span>
    <li><a href="#credential-descriptor-for-a-credential-record">credential descriptor for a credential record</a><span>, in § 4</span>
    <li><a href="#credential-id">Credential ID</a><span>, in § 4</span>
-   <li><a href="#authdata-attestedcredentialdata-credentialid">credentialId</a><span>, in § 6.5.1</span>
+   <li>
+    credentialId
+    <ul>
+     <li><a href="#authdata-attestedcredentialdata-credentialid">dfn for authData/attestedCredentialData</a><span>, in § 6.5.1</span>
+     <li><a href="#dom-unknowncredentialoptions-credentialid">dict-member for UnknownCredentialOptions</a><span>, in § 5.1.10</span>
+    </ul>
    <li><a href="#authdata-attestedcredentialdata-credentialidlength">credentialIdLength</a><span>, in § 6.5.1</span>
    <li><a href="#assertioncreationdata-credentialidresult">credentialIdResult</a><span>, in § 5.1.4.1</span>
    <li><a href="#credential-key-pair">Credential Key Pair</a><span>, in § 4</span>
@@ -9368,6 +10036,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticatorattachment-cross-platform">"cross-platform"</a><span>, in § 5.4.5</span>
    <li><a href="#dom-authenticatorattachment-cross-platform">cross-platform</a><span>, in § 5.4.5</span>
    <li><a href="#cross-platform-attachment">cross-platform attachment</a><span>, in § 6.2.1</span>
+   <li><a href="#signal-method-authenticator-actions-currentuserdetails">currentUserDetails</a><span>, in § 5.1.10.4</span>
+   <li><a href="#dictdef-currentuserdetailsoptions">CurrentUserDetailsOptions</a><span>, in § 5.1.10</span>
    <li><a href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</a><span>, in § 4</span>
    <li><a href="#dom-attestationconveyancepreference-direct">"direct"</a><span>, in § 5.4.7</span>
    <li><a href="#dom-attestationconveyancepreference-direct">direct</a><span>, in § 5.4.7</span>
@@ -9391,6 +10061,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     displayName
     <ul>
+     <li><a href="#dom-currentuserdetailsoptions-displayname">dict-member for CurrentUserDetailsOptions</a><span>, in § 5.1.10</span>
      <li><a href="#dom-publickeycredentialuserentity-displayname">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
      <li><a href="#dom-publickeycredentialuserentityjson-displayname">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
     </ul>
@@ -9420,9 +10091,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-publickeycredentialrequestoptionsjson-extensions">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#dom-authenticationextensionsprfvalues-first">first</a><span>, in § 10.1.4</span>
-   <li><a href="#first-factor-roaming-authenticator">First-factor roaming authenticator</a><span>, in § 6.2</span>
    <li><a href="#authdata-flags">flags</a><span>, in § 6.1</span>
-   <li><a href="#abstract-opdef-supplementalpubkeys-record-fmt">fmt</a><span>, in § 10.2.2.3</span>
    <li><a href="#generating-authenticator">Generating Authenticator</a><span>, in § 4</span>
    <li><a href="#dom-authenticatorattestationresponse-getauthenticatordata">getAuthenticatorData()</a><span>, in § 5.2.1</span>
    <li><a href="#dom-publickeycredential-getclientcapabilities">getClientCapabilities()</a><span>, in § 5.1.7</span>
@@ -9440,18 +10109,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-publickeycredentialrequestoptions-hints">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
      <li><a href="#dom-publickeycredentialrequestoptionsjson-hints">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
-   <li><a href="#human-palatability">Human Palatability</a><span>, in § 4</span>
+   <li><a href="#human-palatability">human palatability</a><span>, in § 4</span>
+   <li><a href="#human-palatability">human-palatable</a><span>, in § 4</span>
    <li>
     "hybrid"
     <ul>
      <li><a href="#dom-authenticatortransport-hybrid">enum-value for AuthenticatorTransport</a><span>, in § 5.8.4</span>
-     <li><a href="#dom-publickeycredentialhints-hybrid">enum-value for PublicKeyCredentialHints</a><span>, in § 5.8.8</span>
+     <li><a href="#dom-publickeycredentialhint-hybrid">enum-value for PublicKeyCredentialHint</a><span>, in § 5.8.8</span>
     </ul>
    <li>
     hybrid
     <ul>
      <li><a href="#dom-authenticatortransport-hybrid">enum-value for AuthenticatorTransport</a><span>, in § 5.8.4</span>
-     <li><a href="#dom-publickeycredentialhints-hybrid">enum-value for PublicKeyCredentialHints</a><span>, in § 5.8.8</span>
+     <li><a href="#dom-publickeycredentialhint-hybrid">enum-value for PublicKeyCredentialHint</a><span>, in § 5.8.8</span>
     </ul>
    <li><a href="#dom-clientcapability-hybridtransport">"hybridTransport"</a><span>, in § 5.8.7</span>
    <li><a href="#dom-clientcapability-hybridtransport">hybridTransport</a><span>, in § 5.8.7</span>
@@ -9495,6 +10165,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     name
     <ul>
+     <li><a href="#dom-currentuserdetailsoptions-name">dict-member for CurrentUserDetailsOptions</a><span>, in § 5.1.10</span>
      <li><a href="#dom-publickeycredentialentity-name">dict-member for PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
      <li><a href="#dom-publickeycredentialuserentityjson-name">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
     </ul>
@@ -9518,6 +10189,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-clientcapability-passkeyplatformauthenticator">"passkeyPlatformAuthenticator"</a><span>, in § 5.8.7</span>
    <li><a href="#passkey-platform-authenticator">Passkey platform authenticator</a><span>, in § 6.2</span>
    <li><a href="#dom-clientcapability-passkeyplatformauthenticator">passkeyPlatformAuthenticator</a><span>, in § 5.8.7</span>
+   <li><a href="#passkey-roaming-authenticator">Passkey roaming authenticator</a><span>, in § 6.2</span>
    <li><a href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an authenticator data structure</a><span>, in § 6.1</span>
    <li><a href="#dom-authenticatorattachment-platform">"platform"</a><span>, in § 5.4.5</span>
    <li><a href="#dom-authenticatorattachment-platform">platform</a><span>, in § 5.4.5</span>
@@ -9572,7 +10244,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
    <li><a href="#dictdef-publickeycredentialdescriptorjson">PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
    <li><a href="#dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
-   <li><a href="#enumdef-publickeycredentialhints">PublicKeyCredentialHints</a><span>, in § 5.8.8</span>
+   <li><a href="#enumdef-publickeycredentialhint">PublicKeyCredentialHint</a><span>, in § 5.8.8</span>
    <li><a href="#typedefdef-publickeycredentialjson">PublicKeyCredentialJSON</a><span>, in § 5.1</span>
    <li><a href="#dictdef-publickeycredentialparameters">PublicKeyCredentialParameters</a><span>, in § 5.3</span>
    <li><a href="#dictdef-publickeycredentialrequestoptions">PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
@@ -9594,10 +10266,14 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     </ul>
    <li><a href="#dom-authenticationextensionslargeblobinputs-read">read</a><span>, in § 10.1.5</span>
    <li><a href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</a><span>, in § 15.1</span>
+   <li><a href="#registrable-origin-label">Registrable Origin Label</a><span>, in § 4</span>
    <li><a href="#registration">Registration</a><span>, in § 4</span>
    <li><a href="#registration-ceremony">Registration Ceremony</a><span>, in § 4</span>
    <li><a href="#registration-extension">registration extension</a><span>, in § 9</span>
    <li><a href="#dictdef-registrationresponsejson">RegistrationResponseJSON</a><span>, in § 5.1</span>
+   <li><a href="#dom-clientcapability-relatedorigins">"relatedOrigins"</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-relatedorigins">relatedOrigins</a><span>, in § 5.8.7</span>
+   <li><a href="#abstract-opdef-related-origins-validation-procedure">related origins validation procedure</a><span>, in § 5.11.1</span>
    <li><a href="#relying-party">Relying Party</a><span>, in § 4</span>
    <li><a href="#relying-party-identifier">Relying Party Identifier</a><span>, in § 4</span>
    <li><a href="#remove-all-credentials">Remove All Credentials</a><span>, in § 11.8</span>
@@ -9644,22 +10320,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     rpId
     <ul>
      <li><a href="#public-key-credential-source-rpid">dfn for public key credential source</a><span>, in § 4</span>
+     <li><a href="#dom-allacceptedcredentialsoptions-rpid">dict-member for AllAcceptedCredentialsOptions</a><span>, in § 5.1.10</span>
+     <li><a href="#dom-currentuserdetailsoptions-rpid">dict-member for CurrentUserDetailsOptions</a><span>, in § 5.1.10</span>
      <li><a href="#dom-publickeycredentialrequestoptions-rpid">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
      <li><a href="#dom-publickeycredentialrequestoptionsjson-rpid">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-unknowncredentialoptions-rpid">dict-member for UnknownCredentialOptions</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#authdata-rpidhash">rpIdHash</a><span>, in § 6.1</span>
-   <li>
-    scope
-    <ul>
-     <li><a href="#abstract-opdef-supplementalpubkeys-record-scope">abstract-op for supplementalPubKeys record</a><span>, in § 10.2.2.3</span>
-     <li><a href="#scope">definition of</a><span>, in § 4</span>
-    </ul>
-   <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes">scopes</a><span>, in § 10.2.2.2</span>
+   <li><a href="#scope">scope</a><span>, in § 4</span>
    <li><a href="#dom-authenticationextensionsprfvalues-second">second</a><span>, in § 10.1.4</span>
    <li><a href="#second-factor-platform-authenticator">Second-factor platform authenticator</a><span>, in § 6.2</span>
    <li><a href="#second-factor-roaming-authenticator">Second-factor roaming authenticator</a><span>, in § 6.2</span>
-   <li><a href="#dom-publickeycredentialhints-security-key">"security-key"</a><span>, in § 5.8.8</span>
-   <li><a href="#dom-publickeycredentialhints-security-key">security-key</a><span>, in § 5.8.8</span>
+   <li><a href="#dom-publickeycredentialhint-security-key">"security-key"</a><span>, in § 5.8.8</span>
+   <li><a href="#dom-publickeycredentialhint-security-key">security-key</a><span>, in § 5.8.8</span>
    <li><a href="#create-selected-authenticator">selected authenticator</a><span>, in § 5.1.3</span>
    <li><a href="#self">Self</a><span>, in § 6.5.3</span>
    <li><a href="#self-attestation">Self Attestation</a><span>, in § 6.5.3</span>
@@ -9669,6 +10342,16 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#set-credential-properties">Set Credential Properties</a><span>, in § 11.10</span>
    <li><a href="#set-credential-properties-parameters">Set Credential Properties Parameters</a><span>, in § 11.10</span>
    <li><a href="#set-user-verified">Set User Verified</a><span>, in § 11.9</span>
+   <li><a href="#dom-clientcapability-signalallacceptedcredentials">"signalAllAcceptedCredentials"</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-signalallacceptedcredentials">signalAllAcceptedCredentials</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-publickeycredential-signalallacceptedcredentials">signalAllAcceptedCredentials(options)</a><span>, in § 5.1.10</span>
+   <li><a href="#dom-clientcapability-signalcurrentuserdetails">"signalCurrentUserDetails"</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-signalcurrentuserdetails">signalCurrentUserDetails</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-publickeycredential-signalcurrentuserdetails">signalCurrentUserDetails(options)</a><span>, in § 5.1.10</span>
+   <li><a href="#signal-methods">signal methods</a><span>, in § 5.1.10</span>
+   <li><a href="#dom-clientcapability-signalunknowncredential">"signalUnknownCredential"</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-clientcapability-signalunknowncredential">signalUnknownCredential</a><span>, in § 5.8.7</span>
+   <li><a href="#dom-publickeycredential-signalunknowncredential">signalUnknownCredential(options)</a><span>, in § 5.1.10</span>
    <li>
     signature
     <ul>
@@ -9677,7 +10360,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     </ul>
    <li><a href="#signature-counter">Signature Counter</a><span>, in § 6.1.1</span>
    <li><a href="#assertioncreationdata-signatureresult">signatureResult</a><span>, in § 5.1.4.1</span>
-   <li><a href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures">signatures</a><span>, in § 10.2.2.2</span>
    <li>
     signCount
     <ul>
@@ -9690,19 +10372,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#single-factor-capable">single-factor capable</a><span>, in § 6.2.3</span>
    <li><a href="#dom-authenticatortransport-smart-card">"smart-card"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-smart-card">smart-card</a><span>, in § 5.8.4</span>
-   <li><a href="#abstract-opdef-supplementalpubkeys-record-spk">spk</a><span>, in § 10.2.2.3</span>
    <li><a href="#dom-tokenbinding-status">status</a><span>, in § 5.8.1</span>
    <li><a href="#dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a><span>, in § 5.1.5</span>
-   <li>
-    supplementalPubKeys
-    <ul>
-     <li><a href="#abstract-opdef-credential-record-supplementalpubkeys">abstract-op for credential record</a><span>, in § 10.2.2.3</span>
-     <li><a href="#supplementalpubkeys">definition of</a><span>, in § 10.2.2</span>
-     <li><a href="#dom-authenticationextensionsclientinputs-supplementalpubkeys">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2.2.2</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2.2.2</span>
-    </ul>
-   <li><a href="#supplemental-public-key">Supplemental public key</a><span>, in § 4</span>
-   <li><a href="#credential-record-supplemental-public-key-record">supplemental public key record</a><span>, in § 10.2.2.3</span>
    <li><a href="#dom-authenticationextensionslargeblobinputs-support">support</a><span>, in § 10.1.5</span>
    <li><a href="#dom-tokenbindingstatus-supported">"supported"</a><span>, in § 5.8.1</span>
    <li>
@@ -9749,6 +10420,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-registrationresponsejson-type">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#ui-redressing">UI Redressing</a><span>, in § 13.4.2</span>
+   <li><a href="#signal-method-authenticator-action-unknowncredentialid">unknownCredentialId</a><span>, in § 5.1.10.2</span>
+   <li><a href="#dictdef-unknowncredentialoptions">UnknownCredentialOptions</a><span>, in § 5.1.10</span>
    <li><a href="#unsigned-extension-outputs">Unsigned extension outputs</a><span>, in § 9.5</span>
    <li><a href="#authdata-flags-up">UP</a><span>, in § 6.1</span>
    <li><a href="#dom-authenticatortransport-usb">"usb"</a><span>, in § 5.8.4</span>
@@ -9761,7 +10434,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     </ul>
    <li><a href="#user-account">User Account</a><span>, in § 4</span>
    <li><a href="#user-consent">User Consent</a><span>, in § 4</span>
-   <li><a href="#user-credential">User Credential</a><span>, in § 4</span>
    <li><a href="#user-handle">User Handle</a><span>, in § 4</span>
    <li>
     userHandle
@@ -9771,6 +10443,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-authenticatorassertionresponsejson-userhandle">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#assertioncreationdata-userhandleresult">userHandleResult</a><span>, in § 5.1.4.1</span>
+   <li>
+    userId
+    <ul>
+     <li><a href="#dom-allacceptedcredentialsoptions-userid">dict-member for AllAcceptedCredentialsOptions</a><span>, in § 5.1.10</span>
+     <li><a href="#dom-currentuserdetailsoptions-userid">dict-member for CurrentUserDetailsOptions</a><span>, in § 5.1.10</span>
+    </ul>
    <li><a href="#concept-user-present">User Present</a><span>, in § 4</span>
    <li><a href="#user-public-key">User Public Key</a><span>, in § 4</span>
    <li><a href="#user-verification">User Verification</a><span>, in § 4</span>
@@ -9781,7 +10459,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-publickeycredentialrequestoptions-userverification">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
      <li><a href="#dom-publickeycredentialrequestoptionsjson-userverification">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
-   <li><a href="#user-verification-method">User Verification Method</a><span>, in § 10.2.1</span>
    <li><a href="#enumdef-userverificationrequirement">UserVerificationRequirement</a><span>, in § 5.8.6</span>
    <li><a href="#concept-user-verified">User Verified</a><span>, in § 4</span>
    <li><a href="#dom-clientcapability-userverifyingplatformauthenticator">"userVerifyingPlatformAuthenticator"</a><span>, in § 5.8.7</span>
@@ -9789,14 +10466,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-clientcapability-userverifyingplatformauthenticator">userVerifyingPlatformAuthenticator</a><span>, in § 5.8.7</span>
    <li><a href="#authdata-flags-uv">UV</a><span>, in § 6.1</span>
    <li><a href="#abstract-opdef-credential-record-uvinitialized">uvInitialized</a><span>, in § 4</span>
-   <li>
-    uvm
-    <ul>
-     <li><a href="#dom-authenticationextensionsclientinputs-uvm">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2.1</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-uvm">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2.1</span>
-    </ul>
-   <li><a href="#typedefdef-uvmentries">UvmEntries</a><span>, in § 10.2.1</span>
-   <li><a href="#typedefdef-uvmentry">UvmEntry</a><span>, in § 10.2.1</span>
    <li><a href="#verification-procedure">Verification procedure</a><span>, in § 6.5.2</span>
    <li><a href="#verification-procedure-inputs">verification procedure inputs</a><span>, in § 6.5.2</span>
    <li><a href="#virtual-authenticator-database">Virtual Authenticator Database</a><span>, in § 11.2</span>
@@ -9835,7 +10504,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="944c2033">credential source</span>
      <li><span class="dfn-paneled" id="99134679">get()</span>
      <li><span class="dfn-paneled" id="cbdd0aff">id</span>
-     <li><span class="dfn-paneled" id="546b09a7">mediation</span>
+     <li><span class="dfn-paneled" id="e05ae7c5">mediation <small>(for CredentialCreationOptions)</small></span>
+     <li><span class="dfn-paneled" id="546b09a7">mediation <small>(for CredentialRequestOptions)</small></span>
      <li><span class="dfn-paneled" id="32f756ae">preventSilentAccess()</span>
      <li><span class="dfn-paneled" id="d0140610">remote</span>
      <li><span class="dfn-paneled" id="6f944459">same-origin with its ancestors</span>
@@ -9853,12 +10523,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="85394472">Document</span>
      <li><span class="dfn-paneled" id="28e64574">abort reason</span>
      <li><span class="dfn-paneled" id="535dd335">aborted</span>
-     <li><span class="dfn-paneled" id="a973e0fe">document</span>
+     <li><span class="dfn-paneled" id="a84c14c9">document</span>
     </ul>
    <li>
     <a data-link-type="biblio">[ECMAScript]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="0204d130">%arraybuffer%</span>
+     <li><span class="dfn-paneled" id="0204d130">%ArrayBuffer%</span>
      <li><span class="dfn-paneled" id="8841d736">internal method</span>
      <li><span class="dfn-paneled" id="c15f1628">internal slot</span>
      <li><span class="dfn-paneled" id="14fea63d">own property</span>
@@ -9866,41 +10536,39 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[ENCODING]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="b0fcb8d7">utf-8 decode</span>
-     <li><span class="dfn-paneled" id="0303e8e5">utf-8 encode</span>
+     <li><span class="dfn-paneled" id="b0fcb8d7">UTF-8 decode</span>
+     <li><span class="dfn-paneled" id="0303e8e5">UTF-8 encode</span>
+    </ul>
+   <li>
+    <a data-link-type="biblio">[FETCH]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="902380f7">credentials mode</span>
+     <li><span class="dfn-paneled" id="07582c28">referrer policy</span>
     </ul>
    <li>
     <a data-link-type="biblio">[FIDO-APPID]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="5bb189f9">determining if a caller's facetid is authorized for an appid</span>
-     <li><span class="dfn-paneled" id="7eefe7a7">determining the facetid of a calling application</span>
+     <li><span class="dfn-paneled" id="5bb189f9">determining if a caller's FacetID is authorized for an AppID</span>
+     <li><span class="dfn-paneled" id="7eefe7a7">determining the FacetID of a calling application</span>
     </ul>
    <li>
     <a data-link-type="biblio">[FIDO-CTAP]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="5a63c8f7">ctap2 canonical cbor encoding form</span>
+     <li><span class="dfn-paneled" id="5a63c8f7">CTAP2 canonical CBOR encoding form</span>
      <li><span class="dfn-paneled" id="7d924173">large, per-credential blobs</span>
-     <li><span class="dfn-paneled" id="d3801403">§6. authenticator api</span>
+     <li><span class="dfn-paneled" id="d3801403">§6. Authenticator API</span>
     </ul>
    <li>
     <a data-link-type="biblio">[FIDO-Registry]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="caa78262">section 3.1 user verification methods</span>
-     <li><span class="dfn-paneled" id="f44435ef">section 3.2 key protection types</span>
-     <li><span class="dfn-paneled" id="94dd0767">section 3.3 matcher protection types</span>
-     <li><span class="dfn-paneled" id="f456317b">section 3.6.2 public key representation formats</span>
+     <li><span class="dfn-paneled" id="f456317b">Section 3.6.2 Public Key Representation Formats</span>
     </ul>
    <li>
     <a data-link-type="biblio">[FIDO-U2F-Message-Formats]</a> defines the following terms:
     <ul>
      <li><span class="dfn-paneled" id="9c6c84a4">application parameter</span>
-     <li><span class="dfn-paneled" id="31236ec1">section 4.3</span>
-     <li><span class="dfn-paneled" id="7b91cdaa">section 5.4</span>
-    </ul>
-   <li>
-    <a data-link-type="biblio">[FileAPI]</a> defines the following terms:
-    <ul>
-     <li><span class="dfn-paneled" id="ea2e2fcc">object</span>
+     <li><span class="dfn-paneled" id="31236ec1">Section 4.3</span>
+     <li><span class="dfn-paneled" id="7b91cdaa">Section 5.4</span>
     </ul>
    <li>
     <a data-link-type="biblio">[HTML]</a> defines the following terms:
@@ -9908,7 +10576,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="5d7209e9">Window</span>
      <li><span class="dfn-paneled" id="57435598">allow</span>
      <li><span class="dfn-paneled" id="3610bd67">allowed to use</span>
-     <li><span class="dfn-paneled" id="b410a6ef">ascii serialization of an origin</span>
+     <li><span class="dfn-paneled" id="b410a6ef">ASCII serialization of an origin</span>
      <li><span class="dfn-paneled" id="9d07aa9a">autocomplete</span>
      <li><span class="dfn-paneled" id="19a777c9">autofill detail token</span>
      <li><span class="dfn-paneled" id="faf954d6">browsing context</span>
@@ -9931,6 +10599,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="a41102eb">permissions policy</span>
      <li><span class="dfn-paneled" id="e99bd18e">relevant global object</span>
      <li><span class="dfn-paneled" id="9c4c1e66">relevant settings object</span>
+     <li><span class="dfn-paneled" id="7393da89">same origin</span>
      <li><span class="dfn-paneled" id="feac4ab3">same site</span>
      <li><span class="dfn-paneled" id="a23d12a9">scheme</span>
      <li><span class="dfn-paneled" id="65181da8">secure context</span>
@@ -9950,25 +10619,25 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="a3b18719">append <small>(for set)</small></span>
      <li><span class="dfn-paneled" id="36858240">boolean</span>
      <li><span class="dfn-paneled" id="3de9e659">byte sequence</span>
+     <li><span class="dfn-paneled" id="ae8def21">contain</span>
      <li><span class="dfn-paneled" id="f937b7b6">continue</span>
      <li><span class="dfn-paneled" id="03afaf9c">empty</span>
      <li><span class="dfn-paneled" id="8958b003">entry</span>
      <li><span class="dfn-paneled" id="1243a891">exist</span>
      <li><span class="dfn-paneled" id="16d07e10">for each <small>(for list)</small></span>
      <li><span class="dfn-paneled" id="45209803">for each <small>(for map)</small></span>
-     <li><span class="dfn-paneled" id="e5ea84f2">intersection</span>
      <li><span class="dfn-paneled" id="6b815fdd">is empty</span>
      <li><span class="dfn-paneled" id="dd460c8e">is not empty</span>
      <li><span class="dfn-paneled" id="5afbefcd">item <small>(for list)</small></span>
      <li><span class="dfn-paneled" id="c88f3887">item <small>(for struct)</small></span>
-     <li><span class="dfn-paneled" id="f02cd417">iterate</span>
      <li><span class="dfn-paneled" id="d14a6f26">key</span>
      <li><span class="dfn-paneled" id="31db57e6">keys</span>
      <li><span class="dfn-paneled" id="649608b9">list</span>
      <li><span class="dfn-paneled" id="3fca5a9e">map</span>
      <li><span class="dfn-paneled" id="692595fe">ordered set</span>
-     <li><span class="dfn-paneled" id="99c988d6">remove</span>
-     <li><span class="dfn-paneled" id="ab309409">serialize json to bytes</span>
+     <li><span class="dfn-paneled" id="99c988d6">remove <small>(for list)</small></span>
+     <li><span class="dfn-paneled" id="7d4424b2">remove <small>(for map)</small></span>
+     <li><span class="dfn-paneled" id="ab309409">serialize JSON to bytes</span>
      <li><span class="dfn-paneled" id="15e48c39">set</span>
      <li><span class="dfn-paneled" id="0e6b2056">set <small>(for map)</small></span>
      <li><span class="dfn-paneled" id="0204d188">size</span>
@@ -9998,7 +10667,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[RFC5280]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="287c5e31">subjectpublickeyinfo</span>
+     <li><span class="dfn-paneled" id="287c5e31">SubjectPublicKeyInfo</span>
     </ul>
    <li>
     <a data-link-type="biblio">[RFC5646]</a> defines the following terms:
@@ -10008,8 +10677,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[RFC8230]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="df6ef2f0">section 2</span>
-     <li><span class="dfn-paneled" id="2a800450">section 4</span>
+     <li><span class="dfn-paneled" id="df6ef2f0">Section 2</span>
+     <li><span class="dfn-paneled" id="2a800450">Section 4</span>
     </ul>
    <li>
     <a data-link-type="biblio">[RFC8610]</a> defines the following terms:
@@ -10019,7 +10688,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[RFC9052]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="a39e599b">cose key</span>
+     <li><span class="dfn-paneled" id="a39e599b">COSE key</span>
      <li><span class="dfn-paneled" id="cece9985">kty</span>
      <li><span class="dfn-paneled" id="87d65d53">section 7</span>
     </ul>
@@ -10045,23 +10714,32 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[TokenBinding]</a> defines the following terms:
     <ul>
-     <li><span class="dfn-paneled" id="fbc75291">token binding</span>
-     <li><span class="dfn-paneled" id="e1812e4c">token binding id</span>
+     <li><span class="dfn-paneled" id="fbc75291">Token Binding</span>
+     <li><span class="dfn-paneled" id="e1812e4c">Token Binding ID</span>
     </ul>
    <li>
     <a data-link-type="biblio">[URL]</a> defines the following terms:
     <ul>
      <li><span class="dfn-paneled" id="22477314">domain</span>
+     <li><span class="dfn-paneled" id="eea18c0d">domain label</span>
      <li><span class="dfn-paneled" id="cfc67fdc">empty host</span>
      <li><span class="dfn-paneled" id="b85ee3be">host</span>
-     <li><span class="dfn-paneled" id="dbde7f99">ipv4 address</span>
-     <li><span class="dfn-paneled" id="d6e2b0d9">ipv6 address</span>
+     <li><span class="dfn-paneled" id="dbde7f99">IPv4 address</span>
+     <li><span class="dfn-paneled" id="d6e2b0d9">IPv6 address</span>
      <li><span class="dfn-paneled" id="a1c25825">opaque host</span>
      <li><span class="dfn-paneled" id="bb3da43a">port</span>
+     <li><span class="dfn-paneled" id="bd6b32a4">public suffix</span>
+     <li><span class="dfn-paneled" id="bc9d7803">registrable domain</span>
      <li><span class="dfn-paneled" id="118b92bb">scheme</span>
+     <li><span class="dfn-paneled" id="ca3ca4ae">URL parser</span>
      <li><span class="dfn-paneled" id="79cad4dd">valid domain</span>
      <li><span class="dfn-paneled" id="8de17130">valid domain string</span>
     </ul>
+   <li>
+    <a data-link-type="biblio">[WEBAUTHN-3]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="aa081c9d">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[WebDriver]</a> defines the following terms:
     <ul>
@@ -10071,17 +10749,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="5b668531">getting a property</span>
      <li><span class="dfn-paneled" id="8da4d1e3">invalid argument</span>
      <li><span class="dfn-paneled" id="1802ab9b">matching capabilities</span>
+     <li><span class="dfn-paneled" id="895f19cb">Object</span>
      <li><span class="dfn-paneled" id="82c23298">remote end steps</span>
      <li><span class="dfn-paneled" id="cb9acc83">set a property</span>
      <li><span class="dfn-paneled" id="4be6272b">success</span>
      <li><span class="dfn-paneled" id="a869e769">unsupported operation</span>
      <li><span class="dfn-paneled" id="d78cb661">validating capabilities</span>
-     <li><span class="dfn-paneled" id="5cf0e148">webdriver error</span>
-     <li><span class="dfn-paneled" id="7482107b">webdriver error code</span>
+     <li><span class="dfn-paneled" id="5cf0e148">WebDriver error</span>
+     <li><span class="dfn-paneled" id="7482107b">WebDriver error code</span>
     </ul>
    <li>
     <a data-link-type="biblio">[WebIDL]</a> defines the following terms:
     <ul>
+     <li><span class="dfn-paneled" id="d25dfb2c">AbortError</span>
      <li><span class="dfn-paneled" id="2f8afbfe">ArrayBuffer</span>
      <li><span class="dfn-paneled" id="3aff2fb3">BufferSource</span>
      <li><span class="dfn-paneled" id="48c6127a">ConstraintError</span>
@@ -10098,20 +10778,26 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="c3e881ef">SecurityError</span>
      <li><span class="dfn-paneled" id="be2d2b4c">SyntaxError</span>
      <li><span class="dfn-paneled" id="82ca3efc">TypeError</span>
-     <li><span class="dfn-paneled" id="b0d7f3c3">USVString</span>
      <li><span class="dfn-paneled" id="81dd847b">UnknownError</span>
+     <li><span class="dfn-paneled" id="dacde8b5">a new promise</span>
+     <li><span class="dfn-paneled" id="d0b4a948">a promise rejected with</span>
+     <li><span class="dfn-paneled" id="8f5c2179">a promise resolved with</span>
      <li><span class="dfn-paneled" id="5372cca8">boolean</span>
      <li><span class="dfn-paneled" id="b05bf85d">buffer source types</span>
      <li><span class="dfn-paneled" id="5bb8971d">enumeration value</span>
-     <li><span class="dfn-paneled" id="7d1b8bad">get a copy of the bytes held by the buffer source</span>
+     <li><span class="dfn-paneled" id="7b05fe24">get a copy of the bytes held by the buffer source</span>
      <li><span class="dfn-paneled" id="4197ac46">interface object</span>
-     <li><span class="dfn-paneled" id="7b052415">json type</span>
+     <li><span class="dfn-paneled" id="7b052415">JSON type</span>
      <li><span class="dfn-paneled" id="f8de33a3">long</span>
-     <li><span class="dfn-paneled" id="9aeb0a82">long long</span>
      <li><span class="dfn-paneled" id="efd1ec5d">object</span>
      <li><span class="dfn-paneled" id="7787d359">record</span>
+     <li><span class="dfn-paneled" id="b262501e">reject</span>
+     <li><span class="dfn-paneled" id="3b90bdcd">resolve</span>
      <li><span class="dfn-paneled" id="9cce47fd">sequence</span>
+     <li><span class="dfn-paneled" id="aa747739">simple exception</span>
+     <li><span class="dfn-paneled" id="5f90bbfb">undefined</span>
      <li><span class="dfn-paneled" id="e97a9688">unsigned long</span>
+     <li><span class="dfn-paneled" id="24bd7d25">upon fulfillment</span>
     </ul>
    <li>
     <a data-link-type="biblio">[WHATWG HTML]</a> defines the following terms:
@@ -10123,7 +10809,7 @@ <h2 class="no-num no-ref heading settled" id="references"><span class="content">
   <h3 class="no-num no-ref heading settled" id="normative"><span class="content">Normative References</span><a class="self-link" href="#normative"></a></h3>
   <dl>
    <dt id="biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]
-   <dd>Nina Satragno. <a href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a>. URL: <a href="https://w3c.github.io/webappsec-credential-management/">https://w3c.github.io/webappsec-credential-management/</a>
+   <dd>Nina Satragno; Marcos Caceres. <a href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a>. URL: <a href="https://w3c.github.io/webappsec-credential-management/">https://w3c.github.io/webappsec-credential-management/</a>
    <dt id="biblio-csp2">[CSP2]
    <dd>Mike West; Adam Barth; Daniel Veditz. <a href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 2</cite></a>. URL: <a href="https://w3c.github.io/webappsec-csp/">https://w3c.github.io/webappsec-csp/</a>
    <dt id="biblio-dom4">[DOM4]
@@ -10132,6 +10818,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd><a href="https://tc39.es/ecma262/multipage/"><cite>ECMAScript Language Specification</cite></a>. URL: <a href="https://tc39.es/ecma262/multipage/">https://tc39.es/ecma262/multipage/</a>
    <dt id="biblio-encoding">[ENCODING]
    <dd>Anne van Kesteren. <a href="https://encoding.spec.whatwg.org/"><cite>Encoding Standard</cite></a>. Living Standard. URL: <a href="https://encoding.spec.whatwg.org/">https://encoding.spec.whatwg.org/</a>
+   <dt id="biblio-fetch">[FETCH]
+   <dd>Anne van Kesteren. <a href="https://fetch.spec.whatwg.org/"><cite>Fetch Standard</cite></a>. Living Standard. URL: <a href="https://fetch.spec.whatwg.org/">https://fetch.spec.whatwg.org/</a>
    <dt id="biblio-fido-appid">[FIDO-APPID]
    <dd>D. Balfanz; et al. <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html"><cite>FIDO AppID and Facet Specification</cite></a>. 27 February 2018. FIDO Alliance Implementation Draft. URL: <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html">https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html</a>
    <dt id="biblio-fido-ctap">[FIDO-CTAP]
@@ -10142,8 +10830,6 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>R. Lindemann; D. Baghdasaryan; B. Hill. <a href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html"><cite>FIDO Registry of Predefined Values</cite></a>. 17 December 2019. FIDO Alliance Proposed Standard. URL: <a href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html">https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html</a>
    <dt id="biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]
    <dd>D. Balfanz; J. Ehrensvard; J. Lang. <a href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html"><cite>FIDO U2F Raw Message Formats</cite></a>. FIDO Alliance Implementation Draft. URL: <a href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html">https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html</a>
-   <dt id="biblio-fileapi">[FileAPI]
-   <dd>Marijn Kruisselbrink. <a href="https://w3c.github.io/FileAPI/"><cite>File API</cite></a>. URL: <a href="https://w3c.github.io/FileAPI/">https://w3c.github.io/FileAPI/</a>
    <dt id="biblio-html">[HTML]
    <dd>Anne van Kesteren; et al. <a href="https://html.spec.whatwg.org/multipage/"><cite>HTML Standard</cite></a>. Living Standard. URL: <a href="https://html.spec.whatwg.org/multipage/">https://html.spec.whatwg.org/multipage/</a>
    <dt id="biblio-i18n-glossary">[I18N-GLOSSARY]
@@ -10192,6 +10878,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>P. Saint-Andre. <a href="https://www.rfc-editor.org/rfc/rfc8266"><cite>Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames</cite></a>. October 2017. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc8266">https://www.rfc-editor.org/rfc/rfc8266</a>
    <dt id="biblio-rfc8610">[RFC8610]
    <dd>H. Birkholz; C. Vigano; C. Bormann. <a href="https://tools.ietf.org/html/rfc8610"><cite>Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures</cite></a>. June 2019. IETF Proposed Standard. URL: <a href="https://tools.ietf.org/html/rfc8610">https://tools.ietf.org/html/rfc8610</a>
+   <dt id="biblio-rfc8615">[RFC8615]
+   <dd>M. Nottingham. <a href="https://www.rfc-editor.org/rfc/rfc8615"><cite>Well-Known Uniform Resource Identifiers (URIs)</cite></a>. May 2019. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc8615">https://www.rfc-editor.org/rfc/rfc8615</a>
    <dt id="biblio-rfc8809">[RFC8809]
    <dd>Jeff Hodges; Giridhar Mandyam; Michael B. Jones. <a href="https://www.rfc-editor.org/rfc/rfc8809"><cite>Registries for Web Authentication (WebAuthn)</cite></a>. August 2020. IETF Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc8809">https://www.rfc-editor.org/rfc/rfc8809</a>
    <dt id="biblio-rfc8949">[RFC8949]
@@ -10209,7 +10897,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-tokenbinding">[TokenBinding]
    <dd>A. Popov; et al. <a href="https://tools.ietf.org/html/rfc8471"><cite>The Token Binding Protocol Version 1.0</cite></a>. October, 2018. IETF Proposed Standard. URL: <a href="https://tools.ietf.org/html/rfc8471">https://tools.ietf.org/html/rfc8471</a>
    <dt id="biblio-tpmv2-ek-profile">[TPMv2-EK-Profile]
-   <dd><a href="https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf"><cite>TCG EK Credential Profile for TPM Family 2.0</cite></a>. URL: <a href="https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf">https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf</a>
+   <dd><a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-V-2.5-R2_published.pdf"><cite>TCG EK Credential Profile for TPM Family 2.0</cite></a>. URL: <a href="https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-V-2.5-R2_published.pdf">https://trustedcomputinggroup.org/wp-content/uploads/TCG-EK-Credential-Profile-V-2.5-R2_published.pdf</a>
    <dt id="biblio-tpmv2-part1">[TPMv2-Part1]
    <dd><a href="https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf"><cite>Trusted Platform Module Library, Part 1: Architecture</cite></a>. URL: <a href="https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf">https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>
    <dt id="biblio-tpmv2-part2">[TPMv2-Part2]
@@ -10219,7 +10907,11 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-url">[URL]
    <dd>Anne van Kesteren. <a href="https://url.spec.whatwg.org/"><cite>URL Standard</cite></a>. Living Standard. URL: <a href="https://url.spec.whatwg.org/">https://url.spec.whatwg.org/</a>
    <dt id="biblio-wcag21">[WCAG21]
-   <dd>Michael Cooper; et al. <a href="https://w3c.github.io/wcag/guidelines/22/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/guidelines/22/">https://w3c.github.io/wcag/guidelines/22/</a>
+   <dd>Michael Cooper; et al. <a href="https://w3c.github.io/wcag/guidelines/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/guidelines/">https://w3c.github.io/wcag/guidelines/</a>
+   <dt id="biblio-webauthn-2-20210408">[WEBAUTHN-2-20210408]
+   <dd>Jeff Hodges; et al. <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/"><cite>Web Authentication: An API for accessing Public Key Credentials - Level 2</cite></a>. URL: <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/">https://www.w3.org/TR/2021/REC-webauthn-2-20210408/</a>
+   <dt id="biblio-webauthn-3">[WEBAUTHN-3]
+   <dd>Michael Jones; Akshay Kumar; Emil Lundberg. <a href="https://w3c.github.io/webauthn/"><cite>Web Authentication: An API for accessing Public Key Credentials - Level 3</cite></a>. URL: <a href="https://w3c.github.io/webauthn/">https://w3c.github.io/webauthn/</a>
    <dt id="biblio-webdriver">[WebDriver]
    <dd>Simon Stewart; David Burns. <a href="https://w3c.github.io/webdriver/"><cite>WebDriver</cite></a>. URL: <a href="https://w3c.github.io/webdriver/">https://w3c.github.io/webdriver/</a>
    <dt id="biblio-webidl">[WebIDL]
@@ -10249,10 +10941,14 @@ <h3 class="no-num no-ref heading settled" id="informative"><span class="content"
    <dd>ISO/IEC JTC1/SC37. <a href="http://standards.iso.org/ittf/PubliclyAvailableStandards/c055194_ISOIEC_2382-37_2012.zip"><cite>Information technology — Vocabulary — Biometrics</cite></a>. 15 December 2012. International Standard: ISO/IEC 2382-37:2012(E) First Edition. URL: <a href="http://standards.iso.org/ittf/PubliclyAvailableStandards/c055194_ISOIEC_2382-37_2012.zip">http://standards.iso.org/ittf/PubliclyAvailableStandards/c055194_ISOIEC_2382-37_2012.zip</a>
    <dt id="biblio-rfc3279">[RFC3279]
    <dd>L. Bassham; W. Polk; R. Housley. <a href="https://www.rfc-editor.org/rfc/rfc3279"><cite>Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile</cite></a>. April 2002. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc3279">https://www.rfc-editor.org/rfc/rfc3279</a>
+   <dt id="biblio-rfc5869">[RFC5869]
+   <dd>H. Krawczyk; P. Eronen. <a href="https://www.rfc-editor.org/rfc/rfc5869"><cite>HMAC-based Extract-and-Expand Key Derivation Function (HKDF)</cite></a>. May 2010. Informational. URL: <a href="https://www.rfc-editor.org/rfc/rfc5869">https://www.rfc-editor.org/rfc/rfc5869</a>
    <dt id="biblio-rfc5958">[RFC5958]
    <dd>S. Turner. <a href="https://www.rfc-editor.org/rfc/rfc5958"><cite>Asymmetric Key Packages</cite></a>. August 2010. Proposed Standard. URL: <a href="https://www.rfc-editor.org/rfc/rfc5958">https://www.rfc-editor.org/rfc/rfc5958</a>
    <dt id="biblio-rfc6265">[RFC6265]
    <dd>A. Barth. <a href="https://httpwg.org/specs/rfc6265.html"><cite>HTTP State Management Mechanism</cite></a>. April 2011. Proposed Standard. URL: <a href="https://httpwg.org/specs/rfc6265.html">https://httpwg.org/specs/rfc6265.html</a>
+   <dt id="biblio-rfc6979">[RFC6979]
+   <dd>T. Pornin. <a href="https://www.rfc-editor.org/rfc/rfc6979"><cite>Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)</cite></a>. August 2013. Informational. URL: <a href="https://www.rfc-editor.org/rfc/rfc6979">https://www.rfc-editor.org/rfc/rfc6979</a>
    <dt id="biblio-rfc8017">[RFC8017]
    <dd>K. Moriarty, Ed.; et al. <a href="https://www.rfc-editor.org/rfc/rfc8017"><cite>PKCS #1: RSA Cryptography Specifications Version 2.2</cite></a>. November 2016. Informational. URL: <a href="https://www.rfc-editor.org/rfc/rfc8017">https://www.rfc-editor.org/rfc/rfc8017</a>
    <dt id="biblio-uafprotocol">[UAFProtocol]
@@ -10281,7 +10977,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 <c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-object"><c- b>object</c-></a> <a href="#typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></a>;
 
 <c- b>dictionary</c-> <a href="#dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-registrationresponsejson-id"><code><c- g>id</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-registrationresponsejson-id"><code><c- g>id</c-></code></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-registrationresponsejson-rawid"><code><c- g>rawId</c-></code></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticatorattestationresponsejson"><c- n>AuthenticatorAttestationResponseJSON</c-></a> <a data-type="AuthenticatorAttestationResponseJSON" href="#dom-registrationresponsejson-response"><code><c- g>response</c-></code></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-registrationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></a>;
@@ -10300,14 +10996,14 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     // algorithm then the public key must be parsed directly from
     // attestationObject or authenticatorData.
     <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-authenticatorattestationresponsejson-publickey"><code><c- g>publicKey</c-></code></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-long-long"><c- b>long</c-> <c- b>long</c-></a> <a data-type="long long" href="#dom-authenticatorattestationresponsejson-publickeyalgorithm"><code><c- g>publicKeyAlgorithm</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier"><c- n>COSEAlgorithmIdentifier</c-></a> <a data-type="COSEAlgorithmIdentifier" href="#dom-authenticatorattestationresponsejson-publickeyalgorithm"><code><c- g>publicKeyAlgorithm</c-></code></a>;
     // This value contains copies of some of the fields above. See
     // section “Easily accessing credential data”.
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-authenticatorattestationresponsejson-attestationobject"><code><c- g>attestationObject</c-></code></a>;
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-authenticationresponsejson"><code><c- g>AuthenticationResponseJSON</c-></code></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-authenticationresponsejson-id"><code><c- g>id</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-authenticationresponsejson-id"><code><c- g>id</c-></code></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString" href="#dom-authenticationresponsejson-rawid"><code><c- g>rawId</c-></code></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-authenticatorassertionresponsejson"><c- n>AuthenticatorAssertionResponseJSON</c-></a> <a data-type="AuthenticatorAssertionResponseJSON" href="#dom-authenticationresponsejson-response"><code><c- g>response</c-></code></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-authenticationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></a>;
@@ -10368,8 +11064,8 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-publickeycredentialdescriptorjson"><code><c- g>PublicKeyCredentialDescriptorJSON</c-></code></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>        <a data-type="Base64URLString" href="#dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>              <a data-type="DOMString" href="#dom-publickeycredentialdescriptorjson-type"><code><c- g>type</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>        <a data-type="Base64URLString" href="#dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>>             <a data-type="sequence<DOMString>" href="#dom-publickeycredentialdescriptorjson-transports"><code><c- g>transports</c-></code></a>;
 };
 
@@ -10390,6 +11086,30 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <a data-type="AuthenticationExtensionsClientInputsJSON" href="#dom-publickeycredentialrequestoptionsjson-extensions"><code><c- g>extensions</c-></code></a>;
 };
 
+<c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined"><c- b>undefined</c-></a>> <a href="#dom-publickeycredential-signalunknowncredential"><code><c- g>signalUnknownCredential</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-unknowncredentialoptions"><c- n>UnknownCredentialOptions</c-></a> <a href="#dom-publickeycredential-signalunknowncredential-options-options"><code><c- g>options</c-></code></a>);
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined"><c- b>undefined</c-></a>> <a href="#dom-publickeycredential-signalallacceptedcredentials"><code><c- g>signalAllAcceptedCredentials</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-allacceptedcredentialsoptions"><c- n>AllAcceptedCredentialsOptions</c-></a> <a href="#dom-publickeycredential-signalallacceptedcredentials-options-options"><code><c- g>options</c-></code></a>);
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-undefined"><c- b>undefined</c-></a>> <a href="#dom-publickeycredential-signalcurrentuserdetails"><code><c- g>signalCurrentUserDetails</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-currentuserdetailsoptions"><c- n>CurrentUserDetailsOptions</c-></a> <a href="#dom-publickeycredential-signalcurrentuserdetails-options-options"><code><c- g>options</c-></code></a>);
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-unknowncredentialoptions"><code><c- g>UnknownCredentialOptions</c-></code></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                     <a data-type="DOMString" href="#dom-unknowncredentialoptions-rpid"><code><c- g>rpId</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>               <a data-type="Base64URLString" href="#dom-unknowncredentialoptions-credentialid"><code><c- g>credentialId</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-allacceptedcredentialsoptions"><code><c- g>AllAcceptedCredentialsOptions</c-></code></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                     <a data-type="DOMString" href="#dom-allacceptedcredentialsoptions-rpid"><code><c- g>rpId</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>               <a data-type="Base64URLString" href="#dom-allacceptedcredentialsoptions-userid"><code><c- g>userId</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>>     <a data-type="sequence<Base64URLString>" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids"><code><c- g>allAcceptedCredentialIds</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-currentuserdetailsoptions"><code><c- g>CurrentUserDetailsOptions</c-></code></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                     <a data-type="DOMString" href="#dom-currentuserdetailsoptions-rpid"><code><c- g>rpId</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>               <a data-type="Base64URLString" href="#dom-currentuserdetailsoptions-userid"><code><c- g>userId</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                     <a data-type="DOMString" href="#dom-currentuserdetailsoptions-name"><code><c- g>name</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                     <a data-type="DOMString" href="#dom-currentuserdetailsoptions-displayname"><code><c- g>displayName</c-></code></a>;
+};
+
 [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson"><c- g>clientDataJSON</c-></a>;
@@ -10473,7 +11193,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource"><c- n>BufferSource</c-></a>                <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialrequestoptions-challenge"><c- g>challenge</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialrequestoptions-timeout"><c- g>timeout</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-publickeycredentialrequestoptions-rpid"><c- g>rpId</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-rpid"><c- g>rpId</c-></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialrequestoptions-allowcredentials"><c- g>allowCredentials</c-></a> = [];
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification"><c- g>userVerification</c-></a> = "preferred";
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints"><c- g>hints</c-></a> = [];
@@ -10490,8 +11210,8 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-type"><c- g>type</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-challenge"><c- g>challenge</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-origin"><c- g>origin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin"><c- g>topOrigin</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-collectedclientdata-crossorigin"><c- g>crossOrigin</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin"><c- g>topOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code></a> {
@@ -10530,20 +11250,24 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 
 <c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-clientcapability"><c- g>ClientCapability</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalcreate"><c- s>"conditionalCreate"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalmediation"><c- s>"conditionalMediation"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-conditionalget"><c- s>"conditionalGet"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-hybridtransport"><c- s>"hybridTransport"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-passkeyplatformauthenticator"><c- s>"passkeyPlatformAuthenticator"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-userverifyingplatformauthenticator"><c- s>"userVerifyingPlatformAuthenticator"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-relatedorigins"><c- s>"relatedOrigins"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalallacceptedcredentials"><c- s>"signalAllAcceptedCredentials"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalcurrentuserdetails"><c- s>"signalCurrentUserDetails"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-signalunknowncredential"><c- s>"signalUnknownCredential"</c-></a>
 };
 
-<c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialhints"><c- g>PublicKeyCredentialHints</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-security-key"><c- s>"security-key"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-client-device"><c- s>"client-device"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhints-hybrid"><c- s>"hybrid"</c-></a>,
+<c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialhint"><c- g>PublicKeyCredentialHint</c-></a> {
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-security-key"><c- s>"security-key"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-client-device"><c- s>"client-device"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialhint-hybrid"><c- s>"hybrid"</c-></a>,
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString" href="#dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -10551,7 +11275,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a data-type="USVString" href="#dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></a>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString" href="#dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -10564,7 +11288,6 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 
 <c- b>dictionary</c-> <a href="#dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-credentialpropertiesoutput-rk"><c- g>rk</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-credentialpropertiesoutput-authenticatordisplayname"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -10578,7 +11301,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 
 <c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></a> {
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues" href="#dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<DOMString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -10619,42 +11342,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-authenticationextensionslargebloboutputs-written"><c- g>written</c-></a>;
 };
 
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a data-type="boolean" href="#dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code></a>;
-};
-
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>> <a href="#typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></a>;
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <a href="#typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></a>;
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a data-link-type="idl-name" href="#typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <a data-type="UvmEntries" href="#dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code></a>;
-};
-
-<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionssupplementalpubkeysinputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysInputs</c-></code></a> {
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
-};
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysinputs"><c- n>AuthenticationExtensionsSupplementalPubKeysInputs</c-></a> <a data-type="AuthenticationExtensionsSupplementalPubKeysInputs" href="#dom-authenticationextensionsclientinputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></a>;
-};
-
-<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionssupplementalpubkeysoutputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></code></a> {
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>> <a data-type="sequence<ArrayBuffer>" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures"><code><c- g>signatures</c-></code></a>;
-};
-
-<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysoutputs"><c- n>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></a> <a data-type="AuthenticationExtensionsSupplementalPubKeysOutputs" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></a>;
-};
-
 </pre>
-  <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content">Issues Index</span><a class="self-link" href="#issues-index"></a></h2>
-  <div style="counter-reset:issue">
-   <div class="issue"> The WHATWG HTML WG is discussing whether to provide a hook when a browsing context gains or
-    loses focuses. If a hook is provided, the above paragraph will be updated to include the hook.
-    See <a href="https://github.com/whatwg/html/issues/2711">WHATWG HTML WG Issue #2711</a> for more details. <a class="issue-return" href="#issue-c0359d2a" title="Jump to section">↵</a></div>
-  </div>
   <details class="mdn-anno unpositioned" data-anno-for="dom-authenticatorassertionresponse-authenticatordata">
    <summary><b class="all-engines-flag" title="This feature is in all current engines.">✔</b><span>MDN</span></summary>
    <div class="feature">
@@ -11121,448 +11809,460 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 {
 let dfnPanelData = {
 "010885a2": {"dfnID":"010885a2","dfnText":"crv","external":true,"refSections":[{"refs":[{"id":"ref-for-name-double-coordinate-curves"},{"id":"ref-for-name-double-coordinate-curves\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-name-double-coordinate-curves\u2461"},{"id":"ref-for-name-double-coordinate-curves\u2462"},{"id":"ref-for-name-double-coordinate-curves\u2463"},{"id":"ref-for-name-double-coordinate-curves\u2464"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}],"url":"https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves"},
-"0204d130": {"dfnID":"0204d130","dfnText":"%arraybuffer%","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-arraybuffer-constructor"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-sec-arraybuffer-constructor\u2460"},{"id":"ref-for-sec-arraybuffer-constructor\u2461"},{"id":"ref-for-sec-arraybuffer-constructor\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-arraybuffer-constructor\u2463"},{"id":"ref-for-sec-arraybuffer-constructor\u2464"},{"id":"ref-for-sec-arraybuffer-constructor\u2465"},{"id":"ref-for-sec-arraybuffer-constructor\u2466"},{"id":"ref-for-sec-arraybuffer-constructor\u2467"},{"id":"ref-for-sec-arraybuffer-constructor\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor"},
-"0204d188": {"dfnID":"0204d188","dfnText":"size","external":true,"refSections":[{"refs":[{"id":"ref-for-list-size"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-size\u2460"},{"id":"ref-for-list-size\u2461"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-list-size\u2462"},{"id":"ref-for-list-size\u2463"},{"id":"ref-for-list-size\u2464"},{"id":"ref-for-list-size\u2465"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#list-size"},
-"0303e8e5": {"dfnID":"0303e8e5","dfnText":"utf-8 encode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-encode"}],"title":"8.5. Android SafetyNet Attestation Statement Format"}],"url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
-"03afaf9c": {"dfnID":"03afaf9c","dfnText":"empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-empty"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-empty\u2460"},{"id":"ref-for-list-empty\u2461"},{"id":"ref-for-list-empty\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-empty\u2463"},{"id":"ref-for-list-empty\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-empty\u2465"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-list-empty\u2466"},{"id":"ref-for-list-empty\u2467"},{"id":"ref-for-list-empty\u2468"},{"id":"ref-for-list-empty\u2460\u24ea"},{"id":"ref-for-list-empty\u2460\u2460"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-list-empty\u2460\u2461"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-list-empty\u2460\u2462"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"https://infra.spec.whatwg.org/#list-empty"},
-"0e6b2056": {"dfnID":"0e6b2056","dfnText":"set (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-set"},{"id":"ref-for-map-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-set\u2461"},{"id":"ref-for-map-set\u2462"},{"id":"ref-for-map-set\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-set\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://infra.spec.whatwg.org/#map-set"},
-"118b92bb": {"dfnID":"118b92bb","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"}],"title":"3. Dependencies"}],"url":"https://url.spec.whatwg.org#concept-url-scheme"},
-"1243a891": {"dfnID":"1243a891","dfnText":"exist","external":true,"refSections":[{"refs":[{"id":"ref-for-map-exists"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-map-exists\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-map-exists\u2461"},{"id":"ref-for-map-exists\u2462"},{"id":"ref-for-map-exists\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-map-exists\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-map-exists\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-map-exists\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-map-exists\u2467"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#map-exists"},
-"12b8dfc0": {"dfnID":"12b8dfc0","dfnText":"current settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-current-settings-object"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
+"0204d130": {"dfnID":"0204d130","dfnText":"%ArrayBuffer%","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-arraybuffer-constructor"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-sec-arraybuffer-constructor\u2460"},{"id":"ref-for-sec-arraybuffer-constructor\u2461"},{"id":"ref-for-sec-arraybuffer-constructor\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-arraybuffer-constructor\u2463"},{"id":"ref-for-sec-arraybuffer-constructor\u2464"},{"id":"ref-for-sec-arraybuffer-constructor\u2465"},{"id":"ref-for-sec-arraybuffer-constructor\u2466"},{"id":"ref-for-sec-arraybuffer-constructor\u2467"},{"id":"ref-for-sec-arraybuffer-constructor\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor"},
+"0204d188": {"dfnID":"0204d188","dfnText":"size","external":true,"refSections":[{"refs":[{"id":"ref-for-list-size"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-size\u2460"},{"id":"ref-for-list-size\u2461"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://infra.spec.whatwg.org/#list-size"},
+"0303e8e5": {"dfnID":"0303e8e5","dfnText":"UTF-8 encode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-encode"}],"title":"8.5. Android SafetyNet Attestation Statement Format"}],"url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
+"03afaf9c": {"dfnID":"03afaf9c","dfnText":"empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-empty"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-empty\u2460"},{"id":"ref-for-list-empty\u2461"},{"id":"ref-for-list-empty\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-empty\u2463"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-list-empty\u2464"},{"id":"ref-for-list-empty\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-empty\u2466"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-list-empty\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"https://infra.spec.whatwg.org/#list-empty"},
+"07582c28": {"dfnID":"07582c28","dfnText":"referrer policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-referrer-policy"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-request-referrer-policy\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://fetch.spec.whatwg.org/#concept-request-referrer-policy"},
+"0e6b2056": {"dfnID":"0e6b2056","dfnText":"set (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-set"},{"id":"ref-for-map-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2461"},{"id":"ref-for-map-set\u2462"},{"id":"ref-for-map-set\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-set\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"https://infra.spec.whatwg.org/#map-set"},
+"118b92bb": {"dfnID":"118b92bb","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-scheme\u2460"},{"id":"ref-for-concept-url-scheme\u2461"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-url-scheme\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://url.spec.whatwg.org#concept-url-scheme"},
+"1243a891": {"dfnID":"1243a891","dfnText":"exist","external":true,"refSections":[{"refs":[{"id":"ref-for-map-exists"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-map-exists\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-map-exists\u2461"},{"id":"ref-for-map-exists\u2462"},{"id":"ref-for-map-exists\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-map-exists\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-map-exists\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-map-exists\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-exists"},
+"12b8dfc0": {"dfnID":"12b8dfc0","dfnText":"current settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-current-settings-object"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-current-settings-object\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
 "14fea63d": {"dfnID":"14fea63d","dfnText":"own property","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-own-property"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://tc39.github.io/ecma262/#sec-own-property"},
-"15e48c39": {"dfnID":"15e48c39","dfnText":"set","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-set"},{"id":"ref-for-ordered-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-set\u2461"},{"id":"ref-for-ordered-set\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-set\u2463"},{"id":"ref-for-ordered-set\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-set\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-ordered-set\u2466"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-ordered-set\u2467"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-ordered-set\u2468"},{"id":"ref-for-ordered-set\u2460\u24ea"},{"id":"ref-for-ordered-set\u2460\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#ordered-set"},
-"16d07e10": {"dfnID":"16d07e10","dfnText":"for each (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-iterate"},{"id":"ref-for-list-iterate\u2460"},{"id":"ref-for-list-iterate\u2461"},{"id":"ref-for-list-iterate\u2462"},{"id":"ref-for-list-iterate\u2463"},{"id":"ref-for-list-iterate\u2464"},{"id":"ref-for-list-iterate\u2465"},{"id":"ref-for-list-iterate\u2466"},{"id":"ref-for-list-iterate\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-iterate\u2468"},{"id":"ref-for-list-iterate\u2460\u24ea"},{"id":"ref-for-list-iterate\u2460\u2460"},{"id":"ref-for-list-iterate\u2460\u2461"},{"id":"ref-for-list-iterate\u2460\u2462"},{"id":"ref-for-list-iterate\u2460\u2463"},{"id":"ref-for-list-iterate\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2468"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-list-iterate\u2461\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2460"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2461"},{"id":"ref-for-list-iterate\u2461\u2462"},{"id":"ref-for-list-iterate\u2461\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#list-iterate"},
+"15e48c39": {"dfnID":"15e48c39","dfnText":"set","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-set"},{"id":"ref-for-ordered-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-set\u2461"},{"id":"ref-for-ordered-set\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-set\u2463"},{"id":"ref-for-ordered-set\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-set\u2465"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-ordered-set\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#ordered-set"},
+"16d07e10": {"dfnID":"16d07e10","dfnText":"for each (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-iterate"},{"id":"ref-for-list-iterate\u2460"},{"id":"ref-for-list-iterate\u2461"},{"id":"ref-for-list-iterate\u2462"},{"id":"ref-for-list-iterate\u2463"},{"id":"ref-for-list-iterate\u2464"},{"id":"ref-for-list-iterate\u2465"},{"id":"ref-for-list-iterate\u2466"},{"id":"ref-for-list-iterate\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-iterate\u2468"},{"id":"ref-for-list-iterate\u2460\u24ea"},{"id":"ref-for-list-iterate\u2460\u2460"},{"id":"ref-for-list-iterate\u2460\u2461"},{"id":"ref-for-list-iterate\u2460\u2462"},{"id":"ref-for-list-iterate\u2460\u2463"},{"id":"ref-for-list-iterate\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2466"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2467"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-list-iterate\u2461\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2460"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://infra.spec.whatwg.org/#list-iterate"},
 "16d98924": {"dfnID":"16d98924","dfnText":"extension capability","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-extension-capability"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-extension-capability\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"https://w3c.github.io/webdriver/#dfn-extension-capability"},
 "1802ab9b": {"dfnID":"1802ab9b","dfnText":"matching capabilities","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-matching-capabilities"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-matching-capabilities\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"https://w3c.github.io/webdriver/#dfn-matching-capabilities"},
-"19a777c9": {"dfnID":"19a777c9","dfnText":"autofill detail token","external":true,"refSections":[{"refs":[{"id":"ref-for-autofill-detail-tokens"},{"id":"ref-for-autofill-detail-tokens\u2460"},{"id":"ref-for-autofill-detail-tokens\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens"},
-"22477314": {"dfnID":"22477314","dfnText":"domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-domain\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-domain\u2461"},{"id":"ref-for-concept-domain\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-domain\u2463"},{"id":"ref-for-concept-domain\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-domain"},
-"267f1f5f": {"dfnID":"267f1f5f","dfnText":"[[Store]](credential, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-store-slot"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot"},
-"287c5e31": {"dfnID":"287c5e31","dfnText":"subjectpublickeyinfo","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4.1.2.7"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-section-4.1.2.7\u2460"},{"id":"ref-for-section-4.1.2.7\u2461"},{"id":"ref-for-section-4.1.2.7\u2462"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc5280#section-4.1.2.7"},
-"28e64574": {"dfnID":"28e64574","dfnText":"abort reason","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-abort-reason"},{"id":"ref-for-abortsignal-abort-reason\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-abort-reason\u2461"},{"id":"ref-for-abortsignal-abort-reason\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://dom.spec.whatwg.org/#abortsignal-abort-reason"},
-"2a800450": {"dfnID":"2a800450","dfnText":"section 4","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-4"},
-"2e66eaf1": {"dfnID":"2e66eaf1","dfnText":"AbortController","external":true,"refSections":[{"refs":[{"id":"ref-for-abortcontroller"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2461"},{"id":"ref-for-abortcontroller\u2462"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortcontroller"},
+"19a777c9": {"dfnID":"19a777c9","dfnText":"autofill detail token","external":true,"refSections":[{"refs":[{"id":"ref-for-autofill-detail-tokens"},{"id":"ref-for-autofill-detail-tokens\u2460"},{"id":"ref-for-autofill-detail-tokens\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens"},
+"22477314": {"dfnID":"22477314","dfnText":"domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-domain\u2460"},{"id":"ref-for-concept-domain\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-domain\u2462"},{"id":"ref-for-concept-domain\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-domain\u2464"},{"id":"ref-for-concept-domain\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#concept-domain"},
+"24bd7d25": {"dfnID":"24bd7d25","dfnText":"upon fulfillment","external":true,"refSections":[{"refs":[{"id":"ref-for-upon-fulfillment"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-upon-fulfillment\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-upon-fulfillment\u2461"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"https://webidl.spec.whatwg.org/#upon-fulfillment"},
+"267f1f5f": {"dfnID":"267f1f5f","dfnText":"[[Store]](credential, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-store-slot"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot"},
+"287c5e31": {"dfnID":"287c5e31","dfnText":"SubjectPublicKeyInfo","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4.1.2.7"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-section-4.1.2.7\u2460"},{"id":"ref-for-section-4.1.2.7\u2461"},{"id":"ref-for-section-4.1.2.7\u2462"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc5280#section-4.1.2.7"},
+"28e64574": {"dfnID":"28e64574","dfnText":"abort reason","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-abort-reason"},{"id":"ref-for-abortsignal-abort-reason\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abortsignal-abort-reason\u2461"},{"id":"ref-for-abortsignal-abort-reason\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://dom.spec.whatwg.org/#abortsignal-abort-reason"},
+"2a800450": {"dfnID":"2a800450","dfnText":"Section 4","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-4"},
+"2e66eaf1": {"dfnID":"2e66eaf1","dfnText":"AbortController","external":true,"refSections":[{"refs":[{"id":"ref-for-abortcontroller"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abortcontroller\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-abortcontroller\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-abortcontroller\u2462"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-abortcontroller\u2463"},{"id":"ref-for-abortcontroller\u2464"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortcontroller"},
 "2ec1d49c": {"dfnID":"2ec1d49c","dfnText":"authentication factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"2f8afbfe": {"dfnID":"2f8afbfe","dfnText":"ArrayBuffer","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-ArrayBuffer"},{"id":"ref-for-idl-ArrayBuffer\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2468"},{"id":"ref-for-idl-ArrayBuffer\u2460\u24ea"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2464"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2468"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2468"},{"id":"ref-for-idl-ArrayBuffer\u2462\u24ea"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},
-"31236ec1": {"dfnID":"31236ec1","dfnText":"section 4.3","external":true,"refSections":[{"refs":[{"id":"ref-for-registration-response-message-success"},{"id":"ref-for-registration-response-message-success\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success"},
-"3182eb71": {"dfnID":"3182eb71","dfnText":"NotSupportedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notsupportederror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2460"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notsupportederror\u2462"},{"id":"ref-for-notsupportederror\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-notsupportederror\u2464"},{"id":"ref-for-notsupportederror\u2465"},{"id":"ref-for-notsupportederror\u2466"},{"id":"ref-for-notsupportederror\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#notsupportederror"},
+"2f8afbfe": {"dfnID":"2f8afbfe","dfnText":"ArrayBuffer","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-ArrayBuffer"},{"id":"ref-for-idl-ArrayBuffer\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2468"},{"id":"ref-for-idl-ArrayBuffer\u2460\u24ea"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2464"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2468"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},
+"31236ec1": {"dfnID":"31236ec1","dfnText":"Section 4.3","external":true,"refSections":[{"refs":[{"id":"ref-for-registration-response-message-success"},{"id":"ref-for-registration-response-message-success\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success"},
+"3182eb71": {"dfnID":"3182eb71","dfnText":"NotSupportedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notsupportederror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-notsupportederror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-notsupportederror\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-notsupportederror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notsupportederror\u2463"},{"id":"ref-for-notsupportederror\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-notsupportederror\u2465"},{"id":"ref-for-notsupportederror\u2466"},{"id":"ref-for-notsupportederror\u2467"},{"id":"ref-for-notsupportederror\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#notsupportederror"},
 "31db57e6": {"dfnID":"31db57e6","dfnText":"keys","external":true,"refSections":[{"refs":[{"id":"ref-for-map-getting-the-keys"},{"id":"ref-for-map-getting-the-keys\u2460"},{"id":"ref-for-map-getting-the-keys\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://infra.spec.whatwg.org/#map-getting-the-keys"},
-"31e1c2ad": {"dfnID":"31e1c2ad","dfnText":"store()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-store"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store"},
+"31e1c2ad": {"dfnID":"31e1c2ad","dfnText":"store()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-store"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store"},
 "32f756ae": {"dfnID":"32f756ae","dfnText":"preventSilentAccess()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-preventsilentaccess"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess"},
 "3610bd67": {"dfnID":"3610bd67","dfnText":"allowed to use","external":true,"refSections":[{"refs":[{"id":"ref-for-allowed-to-use"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-allowed-to-use\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-allowed-to-use\u2461"},{"id":"ref-for-allowed-to-use\u2462"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
 "36858240": {"dfnID":"36858240","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-boolean"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-boolean\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"https://infra.spec.whatwg.org/#boolean"},
 "38a4f3d4": {"dfnID":"38a4f3d4","dfnText":"something you are","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"3aff2fb3": {"dfnID":"3aff2fb3","dfnText":"BufferSource","external":true,"refSections":[{"refs":[{"id":"ref-for-BufferSource"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-BufferSource\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-BufferSource\u2461"},{"id":"ref-for-BufferSource\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2463"},{"id":"ref-for-BufferSource\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-BufferSource\u2465"},{"id":"ref-for-BufferSource\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2467"},{"id":"ref-for-BufferSource\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u24ea"},{"id":"ref-for-BufferSource\u2460\u2460"},{"id":"ref-for-BufferSource\u2460\u2461"},{"id":"ref-for-BufferSource\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2463"},{"id":"ref-for-BufferSource\u2460\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#BufferSource"},
+"3aff2fb3": {"dfnID":"3aff2fb3","dfnText":"BufferSource","external":true,"refSections":[{"refs":[{"id":"ref-for-BufferSource"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2461"},{"id":"ref-for-BufferSource\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2463"},{"id":"ref-for-BufferSource\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-BufferSource\u2465"},{"id":"ref-for-BufferSource\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2467"},{"id":"ref-for-BufferSource\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u24ea"},{"id":"ref-for-BufferSource\u2460\u2460"},{"id":"ref-for-BufferSource\u2460\u2461"},{"id":"ref-for-BufferSource\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2463"},{"id":"ref-for-BufferSource\u2460\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2465"}],"title":"16.2.1.1. Web Authentication API"}],"url":"https://webidl.spec.whatwg.org/#BufferSource"},
+"3b90bdcd": {"dfnID":"3b90bdcd","dfnText":"resolve","external":true,"refSections":[{"refs":[{"id":"ref-for-resolve"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#resolve"},
 "3de9e659": {"dfnID":"3de9e659","dfnText":"byte sequence","external":true,"refSections":[{"refs":[{"id":"ref-for-byte-sequence"},{"id":"ref-for-byte-sequence\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-byte-sequence\u2461"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"https://infra.spec.whatwg.org/#byte-sequence"},
-"3e12e042": {"dfnID":"3e12e042","dfnText":"environment settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-environment-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
-"3fca5a9e": {"dfnID":"3fca5a9e","dfnText":"map","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-map"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ordered-map\u2460"},{"id":"ref-for-ordered-map\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-map\u2462"},{"id":"ref-for-ordered-map\u2463"},{"id":"ref-for-ordered-map\u2464"},{"id":"ref-for-ordered-map\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-map\u2466"},{"id":"ref-for-ordered-map\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-map\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-ordered-map\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-ordered-map\u2460\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-ordered-map\u2460\u2461"}],"title":"9.4. Client Extension Processing"}],"url":"https://infra.spec.whatwg.org/#ordered-map"},
-"4197ac46": {"dfnID":"4197ac46","dfnText":"interface object","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-interface-object"},{"id":"ref-for-dfn-interface-object\u2460"},{"id":"ref-for-dfn-interface-object\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dfn-interface-object\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://webidl.spec.whatwg.org/#dfn-interface-object"},
-"43ac8374": {"dfnID":"43ac8374","dfnText":"origin (for environment settings object)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-origin"},{"id":"ref-for-concept-settings-object-origin\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2461"},{"id":"ref-for-concept-settings-object-origin\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2463"},{"id":"ref-for-concept-settings-object-origin\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
-"45209803": {"dfnID":"45209803","dfnText":"for each (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-iterate"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-map-iterate\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-iterate\u2463"},{"id":"ref-for-map-iterate\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-map-iterate\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-map-iterate\u2466"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#map-iterate"},
-"47fe679e": {"dfnID":"47fe679e","dfnText":"transient activation","external":true,"refSections":[{"refs":[{"id":"ref-for-transient-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
-"48c6127a": {"dfnID":"48c6127a","dfnText":"ConstraintError","external":true,"refSections":[{"refs":[{"id":"ref-for-constrainterror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-constrainterror\u2460"},{"id":"ref-for-constrainterror\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://webidl.spec.whatwg.org/#constrainterror"},
-"4a044e45": {"dfnID":"4a044e45","dfnText":"is not a registrable domain suffix of and is not equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"3e12e042": {"dfnID":"3e12e042","dfnText":"environment settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-environment-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
+"3fca5a9e": {"dfnID":"3fca5a9e","dfnText":"map","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-map"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ordered-map\u2460"},{"id":"ref-for-ordered-map\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-map\u2462"},{"id":"ref-for-ordered-map\u2463"},{"id":"ref-for-ordered-map\u2464"},{"id":"ref-for-ordered-map\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-map\u2466"},{"id":"ref-for-ordered-map\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-map\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-ordered-map\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-ordered-map\u2460\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-ordered-map\u2460\u2461"}],"title":"9.4. Client Extension Processing"}],"url":"https://infra.spec.whatwg.org/#ordered-map"},
+"4197ac46": {"dfnID":"4197ac46","dfnText":"interface object","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-interface-object"},{"id":"ref-for-dfn-interface-object\u2460"},{"id":"ref-for-dfn-interface-object\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dfn-interface-object\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://webidl.spec.whatwg.org/#dfn-interface-object"},
+"43ac8374": {"dfnID":"43ac8374","dfnText":"origin (for environment settings object)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-origin"},{"id":"ref-for-concept-settings-object-origin\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2461"},{"id":"ref-for-concept-settings-object-origin\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2463"},{"id":"ref-for-concept-settings-object-origin\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2465"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
+"45209803": {"dfnID":"45209803","dfnText":"for each (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-iterate"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-iterate\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-iterate\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-map-iterate\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-map-iterate\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-iterate\u2464"},{"id":"ref-for-map-iterate\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-map-iterate\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#map-iterate"},
+"47fe679e": {"dfnID":"47fe679e","dfnText":"transient activation","external":true,"refSections":[{"refs":[{"id":"ref-for-transient-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
+"48c6127a": {"dfnID":"48c6127a","dfnText":"ConstraintError","external":true,"refSections":[{"refs":[{"id":"ref-for-constrainterror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-constrainterror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-constrainterror\u2461"},{"id":"ref-for-constrainterror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://webidl.spec.whatwg.org/#constrainterror"},
+"4a044e45": {"dfnID":"4a044e45","dfnText":"is not a registrable domain suffix of and is not equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2464"}],"title":"5.11. Using Web Authentication across related origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
 "4be6272b": {"dfnID":"4be6272b","dfnText":"success","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-success"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2460"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2461"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-success\u2462"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2463"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-success\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2465"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-success\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-success"},
-"53275e46": {"dfnID":"53275e46","dfnText":"append (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-append"},{"id":"ref-for-list-append\u2460"},{"id":"ref-for-list-append\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-append\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list-append"},
-"535dd335": {"dfnID":"535dd335","dfnText":"aborted","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-aborted"},{"id":"ref-for-abortsignal-aborted\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2461"},{"id":"ref-for-abortsignal-aborted\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2463"},{"id":"ref-for-abortsignal-aborted\u2464"},{"id":"ref-for-abortsignal-aborted\u2465"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortsignal-aborted"},
-"5372cca8": {"dfnID":"5372cca8","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-boolean"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-boolean\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2462"},{"id":"ref-for-idl-boolean\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-boolean\u2464"},{"id":"ref-for-idl-boolean\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-boolean\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-boolean\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-boolean\u2468"},{"id":"ref-for-idl-boolean\u2460\u24ea"},{"id":"ref-for-idl-boolean\u2460\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2461"},{"id":"ref-for-idl-boolean\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2463"},{"id":"ref-for-idl-boolean\u2460\u2464"},{"id":"ref-for-idl-boolean\u2460\u2465"},{"id":"ref-for-idl-boolean\u2460\u2466"},{"id":"ref-for-idl-boolean\u2460\u2467"},{"id":"ref-for-idl-boolean\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-boolean\u2461\u24ea"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://webidl.spec.whatwg.org/#idl-boolean"},
-"546b09a7": {"dfnID":"546b09a7","dfnText":"mediation","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2461"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2462"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2463"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2464"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation"},
+"53275e46": {"dfnID":"53275e46","dfnText":"append (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-append"},{"id":"ref-for-list-append\u2460"},{"id":"ref-for-list-append\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-append\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list-append"},
+"535dd335": {"dfnID":"535dd335","dfnText":"aborted","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-aborted"},{"id":"ref-for-abortsignal-aborted\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2461"},{"id":"ref-for-abortsignal-aborted\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abortsignal-aborted\u2463"},{"id":"ref-for-abortsignal-aborted\u2464"},{"id":"ref-for-abortsignal-aborted\u2465"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortsignal-aborted"},
+"5372cca8": {"dfnID":"5372cca8","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-boolean"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-boolean\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-boolean\u2462"},{"id":"ref-for-idl-boolean\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-boolean\u2464"},{"id":"ref-for-idl-boolean\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-boolean\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-boolean\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-boolean\u2468"},{"id":"ref-for-idl-boolean\u2460\u24ea"},{"id":"ref-for-idl-boolean\u2460\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2461"},{"id":"ref-for-idl-boolean\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-boolean\u2460\u2463"},{"id":"ref-for-idl-boolean\u2460\u2464"},{"id":"ref-for-idl-boolean\u2460\u2465"},{"id":"ref-for-idl-boolean\u2460\u2466"},{"id":"ref-for-idl-boolean\u2460\u2467"},{"id":"ref-for-idl-boolean\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-boolean"},
+"546b09a7": {"dfnID":"546b09a7","dfnText":"mediation (for CredentialRequestOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-mediation\u2461"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2462"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2463"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2464"},{"id":"ref-for-dom-credentialrequestoptions-mediation\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation"},
 "57435598": {"dfnID":"57435598","dfnText":"allow","external":true,"refSections":[{"refs":[{"id":"ref-for-attr-iframe-allow"},{"id":"ref-for-attr-iframe-allow\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow"},
 "588dbb2c": {"dfnID":"588dbb2c","dfnText":"Create a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-create-a-credential"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential"},
-"59825b02": {"dfnID":"59825b02","dfnText":"CredentialsContainer","external":true,"refSections":[{"refs":[{"id":"ref-for-credentialscontainer"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credentialscontainer\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-credentialscontainer\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},
-"5a63c8f7": {"dfnID":"5a63c8f7","dfnText":"ctap2 canonical cbor encoding form","external":true,"refSections":[{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form"},{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2460"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2461"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2464"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
-"5afbefcd": {"dfnID":"5afbefcd","dfnText":"item (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-item"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-item\u2460"},{"id":"ref-for-list-item\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-item\u2462"},{"id":"ref-for-list-item\u2463"},{"id":"ref-for-list-item\u2464"},{"id":"ref-for-list-item\u2465"},{"id":"ref-for-list-item\u2466"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-item\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-item\u2468"},{"id":"ref-for-list-item\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-list-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-list-item\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-list-item\u2460\u2462"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"https://infra.spec.whatwg.org/#list-item"},
+"59825b02": {"dfnID":"59825b02","dfnText":"CredentialsContainer","external":true,"refSections":[{"refs":[{"id":"ref-for-credentialscontainer"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credentialscontainer\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-credentialscontainer\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credentialscontainer\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},
+"5a63c8f7": {"dfnID":"5a63c8f7","dfnText":"CTAP2 canonical CBOR encoding form","external":true,"refSections":[{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form"},{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2460"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2461"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-ctap2-canonical-cbor-encoding-form\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
+"5afbefcd": {"dfnID":"5afbefcd","dfnText":"item (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-item"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-item\u2460"},{"id":"ref-for-list-item\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-item\u2462"},{"id":"ref-for-list-item\u2463"},{"id":"ref-for-list-item\u2464"},{"id":"ref-for-list-item\u2465"},{"id":"ref-for-list-item\u2466"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-item\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-item\u2468"},{"id":"ref-for-list-item\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-list-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-list-item\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-list-item\u2460\u2462"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"https://infra.spec.whatwg.org/#list-item"},
 "5b668531": {"dfnID":"5b668531","dfnText":"getting a property","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-getting-properties"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-getting-properties"},
-"5bb189f9": {"dfnID":"5bb189f9","dfnText":"determining if a caller's facetid is authorized for an appid","external":true,"refSections":[{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2460"},{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2462"},{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid"},
+"5bb189f9": {"dfnID":"5bb189f9","dfnText":"determining if a caller's FacetID is authorized for an AppID","external":true,"refSections":[{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2460"},{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2462"},{"id":"ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid"},
 "5bb8971d": {"dfnID":"5bb8971d","dfnText":"enumeration value","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-enumeration-value"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://webidl.spec.whatwg.org/#dfn-enumeration-value"},
-"5cf0e148": {"dfnID":"5cf0e148","dfnText":"webdriver error","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error\u2461"},{"id":"ref-for-dfn-error\u2462"},{"id":"ref-for-dfn-error\u2463"},{"id":"ref-for-dfn-error\u2464"},{"id":"ref-for-dfn-error\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error\u2467"},{"id":"ref-for-dfn-error\u2468"},{"id":"ref-for-dfn-error\u2460\u24ea"},{"id":"ref-for-dfn-error\u2460\u2460"},{"id":"ref-for-dfn-error\u2460\u2461"},{"id":"ref-for-dfn-error\u2460\u2462"},{"id":"ref-for-dfn-error\u2460\u2463"},{"id":"ref-for-dfn-error\u2460\u2464"},{"id":"ref-for-dfn-error\u2460\u2465"},{"id":"ref-for-dfn-error\u2460\u2466"},{"id":"ref-for-dfn-error\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error\u2461\u24ea"},{"id":"ref-for-dfn-error\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2462"},{"id":"ref-for-dfn-error\u2461\u2463"},{"id":"ref-for-dfn-error\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2465"},{"id":"ref-for-dfn-error\u2461\u2466"},{"id":"ref-for-dfn-error\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error"},
-"5d055361": {"dfnID":"5d055361","dfnText":"grapheme cluster","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-grapheme-cluster"},{"id":"ref-for-dfn-grapheme-cluster\u2460"},{"id":"ref-for-dfn-grapheme-cluster\u2461"},{"id":"ref-for-dfn-grapheme-cluster\u2462"}],"title":"6.4.1. String Truncation"}],"url":"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster"},
+"5cf0e148": {"dfnID":"5cf0e148","dfnText":"WebDriver error","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error\u2461"},{"id":"ref-for-dfn-error\u2462"},{"id":"ref-for-dfn-error\u2463"},{"id":"ref-for-dfn-error\u2464"},{"id":"ref-for-dfn-error\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error\u2467"},{"id":"ref-for-dfn-error\u2468"},{"id":"ref-for-dfn-error\u2460\u24ea"},{"id":"ref-for-dfn-error\u2460\u2460"},{"id":"ref-for-dfn-error\u2460\u2461"},{"id":"ref-for-dfn-error\u2460\u2462"},{"id":"ref-for-dfn-error\u2460\u2463"},{"id":"ref-for-dfn-error\u2460\u2464"},{"id":"ref-for-dfn-error\u2460\u2465"},{"id":"ref-for-dfn-error\u2460\u2466"},{"id":"ref-for-dfn-error\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error\u2461\u24ea"},{"id":"ref-for-dfn-error\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2462"},{"id":"ref-for-dfn-error\u2461\u2463"},{"id":"ref-for-dfn-error\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error\u2461\u2465"},{"id":"ref-for-dfn-error\u2461\u2466"},{"id":"ref-for-dfn-error\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error"},
+"5d055361": {"dfnID":"5d055361","dfnText":"grapheme cluster","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-grapheme-cluster"},{"id":"ref-for-dfn-grapheme-cluster\u2460"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-dfn-grapheme-cluster\u2461"},{"id":"ref-for-dfn-grapheme-cluster\u2462"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-dfn-grapheme-cluster\u2463"},{"id":"ref-for-dfn-grapheme-cluster\u2464"}],"title":"6.4.1.2. String Truncation by Authenticators"}],"url":"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster"},
 "5d7209e9": {"dfnID":"5d7209e9","dfnText":"Window","external":true,"refSections":[{"refs":[{"id":"ref-for-window"},{"id":"ref-for-window\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window"},
+"5f90bbfb": {"dfnID":"5f90bbfb","dfnText":"undefined","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-undefined"},{"id":"ref-for-idl-undefined\u2460"},{"id":"ref-for-idl-undefined\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"}],"url":"https://webidl.spec.whatwg.org/#idl-undefined"},
 "638c93e7": {"dfnID":"638c93e7","dfnText":"visibility states","external":true,"refSections":[{"refs":[{"id":"ref-for-visibility-states"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://www.w3.org/TR/page-visibility/#visibility-states"},
-"649608b9": {"dfnID":"649608b9","dfnText":"list","external":true,"refSections":[{"refs":[{"id":"ref-for-list"},{"id":"ref-for-list\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list\u2461"},{"id":"ref-for-list\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list\u2463"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-list\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list"},
+"649608b9": {"dfnID":"649608b9","dfnText":"list","external":true,"refSections":[{"refs":[{"id":"ref-for-list"},{"id":"ref-for-list\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list\u2461"},{"id":"ref-for-list\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list\u2463"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-list\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list"},
 "65181da8": {"dfnID":"65181da8","dfnText":"secure context","external":true,"refSections":[{"refs":[{"id":"ref-for-secure-context"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-secure-context\u2460"}],"title":"13.4.8. Code injection attacks"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#secure-context"},
-"692595fe": {"dfnID":"692595fe","dfnText":"ordered set","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-set"},{"id":"ref-for-ordered-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-set\u2461"},{"id":"ref-for-ordered-set\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ordered-set\u2463"},{"id":"ref-for-ordered-set\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-set\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-ordered-set\u2466"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-ordered-set\u2467"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-ordered-set\u2468"},{"id":"ref-for-ordered-set\u2460\u24ea"},{"id":"ref-for-ordered-set\u2460\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#ordered-set"},
-"696a29e8": {"dfnID":"696a29e8","dfnText":"Request a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
-"6b815fdd": {"dfnID":"6b815fdd","dfnText":"is empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
-"6f944459": {"dfnID":"6f944459","dfnText":"same-origin with its ancestors","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin-with-its-ancestors"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
-"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"},{"id":"ref-for-concept-credential\u2460\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"},{"id":"ref-for-concept-credential\u2461\u2463"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2464"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2465"},{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
-"7482107b": {"dfnID":"7482107b","dfnText":"webdriver error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"},{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"},{"id":"ref-for-dfn-error-code\u2468"},{"id":"ref-for-dfn-error-code\u2460\u24ea"},{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"},{"id":"ref-for-dfn-error-code\u2460\u2462"},{"id":"ref-for-dfn-error-code\u2460\u2463"},{"id":"ref-for-dfn-error-code\u2460\u2464"},{"id":"ref-for-dfn-error-code\u2460\u2465"},{"id":"ref-for-dfn-error-code\u2460\u2466"},{"id":"ref-for-dfn-error-code\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u24ea"},{"id":"ref-for-dfn-error-code\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2462"},{"id":"ref-for-dfn-error-code\u2461\u2463"},{"id":"ref-for-dfn-error-code\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2465"},{"id":"ref-for-dfn-error-code\u2461\u2466"},{"id":"ref-for-dfn-error-code\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
+"692595fe": {"dfnID":"692595fe","dfnText":"ordered set","external":true,"refSections":[{"refs":[{"id":"ref-for-ordered-set"},{"id":"ref-for-ordered-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-set\u2461"},{"id":"ref-for-ordered-set\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ordered-set\u2463"},{"id":"ref-for-ordered-set\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-ordered-set\u2465"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-ordered-set\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#ordered-set"},
+"696a29e8": {"dfnID":"696a29e8","dfnText":"Request a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
+"6b815fdd": {"dfnID":"6b815fdd","dfnText":"is empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
+"6f944459": {"dfnID":"6f944459","dfnText":"same-origin with its ancestors","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin-with-its-ancestors"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2463"},{"id":"ref-for-same-origin-with-its-ancestors\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2465"},{"id":"ref-for-same-origin-with-its-ancestors\u2466"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
+"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"},{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2464"},{"id":"ref-for-concept-credential\u2460\u2465"},{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2464"},{"id":"ref-for-concept-credential\u2461\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2468"},{"id":"ref-for-concept-credential\u2462\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2460"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2461"},{"id":"ref-for-concept-credential\u2462\u2462"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2463"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2464"},{"id":"ref-for-concept-credential\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2466"}],"title":"16. Test Vectors"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
+"7393da89": {"dfnID":"7393da89","dfnText":"same origin","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-origin"},
+"7482107b": {"dfnID":"7482107b","dfnText":"WebDriver error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"},{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"},{"id":"ref-for-dfn-error-code\u2468"},{"id":"ref-for-dfn-error-code\u2460\u24ea"},{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"},{"id":"ref-for-dfn-error-code\u2460\u2462"},{"id":"ref-for-dfn-error-code\u2460\u2463"},{"id":"ref-for-dfn-error-code\u2460\u2464"},{"id":"ref-for-dfn-error-code\u2460\u2465"},{"id":"ref-for-dfn-error-code\u2460\u2466"},{"id":"ref-for-dfn-error-code\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u24ea"},{"id":"ref-for-dfn-error-code\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2462"},{"id":"ref-for-dfn-error-code\u2461\u2463"},{"id":"ref-for-dfn-error-code\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2465"},{"id":"ref-for-dfn-error-code\u2461\u2466"},{"id":"ref-for-dfn-error-code\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
 "7787d359": {"dfnID":"7787d359","dfnText":"record","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-record"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-record\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-record"},
 "77a2ee6e": {"dfnID":"77a2ee6e","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-host"},{"id":"ref-for-concept-origin-host\u2460"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host"},
-"797018a7": {"dfnID":"797018a7","dfnText":"InvalidStateError","external":true,"refSections":[{"refs":[{"id":"ref-for-invalidstateerror"},{"id":"ref-for-invalidstateerror\u2460"},{"id":"ref-for-invalidstateerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-invalidstateerror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-invalidstateerror\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-invalidstateerror\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
-"79cad4dd": {"dfnID":"79cad4dd","dfnText":"valid domain","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-valid-domain\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#valid-domain"},
+"797018a7": {"dfnID":"797018a7","dfnText":"InvalidStateError","external":true,"refSections":[{"refs":[{"id":"ref-for-invalidstateerror"},{"id":"ref-for-invalidstateerror\u2460"},{"id":"ref-for-invalidstateerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-invalidstateerror\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-invalidstateerror\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-invalidstateerror\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-invalidstateerror\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
+"79cad4dd": {"dfnID":"79cad4dd","dfnText":"valid domain","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-valid-domain\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-valid-domain\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-valid-domain\u2463"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-valid-domain\u2464"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://url.spec.whatwg.org/#valid-domain"},
 "79ff34a5": {"dfnID":"79ff34a5","dfnText":"Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-credential"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-credential\u2460"},{"id":"ref-for-credential\u2461"},{"id":"ref-for-credential\u2462"},{"id":"ref-for-credential\u2463"},{"id":"ref-for-credential\u2464"},{"id":"ref-for-credential\u2465"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#credential"},
 "7ad9ecbb": {"dfnID":"7ad9ecbb","dfnText":"something you have","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"7b052415": {"dfnID":"7b052415","dfnText":"json type","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-json-types"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dfn-json-types\u2460"},{"id":"ref-for-dfn-json-types\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-json-types\u2462"},{"id":"ref-for-dfn-json-types\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
-"7b91cdaa": {"dfnID":"7b91cdaa","dfnText":"section 5.4","external":true,"refSections":[{"refs":[{"id":"ref-for-authentication-response-message-success"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},
+"7b052415": {"dfnID":"7b052415","dfnText":"JSON type","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-json-types"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dfn-json-types\u2460"},{"id":"ref-for-dfn-json-types\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-json-types\u2462"},{"id":"ref-for-dfn-json-types\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
+"7b05fe24": {"dfnID":"7b05fe24","dfnText":"get a copy of the bytes held by the buffer source","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy"},
+"7b91cdaa": {"dfnID":"7b91cdaa","dfnText":"Section 5.4","external":true,"refSections":[{"refs":[{"id":"ref-for-authentication-response-message-success"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},
 "7c356e70": {"dfnID":"7c356e70","dfnText":"second-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"7d1b8bad": {"dfnID":"7d1b8bad","dfnText":"get a copy of the bytes held by the buffer source","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://heycam.github.io/webidl#dfn-get-buffer-source-copy"},
+"7d4424b2": {"dfnID":"7d4424b2","dfnText":"remove (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-remove"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-map-remove\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"https://infra.spec.whatwg.org/#map-remove"},
 "7d924173": {"dfnID":"7d924173","dfnText":"large, per-credential blobs","external":true,"refSections":[{"refs":[{"id":"ref-for-authenticatorLargeBlobs"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticatorLargeBlobs\u2460"},{"id":"ref-for-authenticatorLargeBlobs\u2461"}],"title":"11.5. Add Credential"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs"},
-"7eefe7a7": {"dfnID":"7eefe7a7","dfnText":"determining the facetid of a calling application","external":true,"refSections":[{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2460"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application"},
+"7eefe7a7": {"dfnID":"7eefe7a7","dfnText":"determining the FacetID of a calling application","external":true,"refSections":[{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2460"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application"},
 "802b0fdd": {"dfnID":"802b0fdd","dfnText":"value","external":true,"refSections":[{"refs":[{"id":"ref-for-map-value"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-value"},
 "81daedb9": {"dfnID":"81daedb9","dfnText":"focus","external":true,"refSections":[{"refs":[{"id":"ref-for-focus"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://html.spec.whatwg.org/#focus"},
 "81dd847b": {"dfnID":"81dd847b","dfnText":"UnknownError","external":true,"refSections":[{"refs":[{"id":"ref-for-unknownerror"},{"id":"ref-for-unknownerror\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-unknownerror\u2461"},{"id":"ref-for-unknownerror\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#unknownerror"},
 "82c23298": {"dfnID":"82c23298","dfnText":"remote end steps","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-remote-end-steps"},{"id":"ref-for-dfn-remote-end-steps\u2460"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2461"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2462"},{"id":"ref-for-dfn-remote-end-steps\u2463"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2464"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2465"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2466"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2467"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2468"},{"id":"ref-for-dfn-remote-end-steps\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-remote-end-steps"},
-"82ca3efc": {"dfnID":"82ca3efc","dfnText":"TypeError","external":true,"refSections":[{"refs":[{"id":"ref-for-exceptiondef-typeerror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
+"82ca3efc": {"dfnID":"82ca3efc","dfnText":"TypeError","external":true,"refSections":[{"refs":[{"id":"ref-for-exceptiondef-typeerror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2461"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2463"},{"id":"ref-for-exceptiondef-typeerror\u2464"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2465"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
 "85394472": {"dfnID":"85394472","dfnText":"Document","external":true,"refSections":[{"refs":[{"id":"ref-for-document"}],"title":"5.9. Permissions Policy integration"}],"url":"https://dom.spec.whatwg.org/#document"},
 "87478abb": {"dfnID":"87478abb","dfnText":"document.domain","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-document-domain"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
 "87d65d53": {"dfnID":"87d65d53","dfnText":"section 7","external":true,"refSections":[{"refs":[{"id":"ref-for-section-7"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-section-7\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-section-7\u2461"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-section-7\u2462"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://tools.ietf.org/html/rfc9052#section-7"},
-"87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"},{"id":"ref-for-the-iframe-element\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"},{"id":"ref-for-the-iframe-element\u2466"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
-"8841d736": {"dfnID":"8841d736","dfnText":"internal method","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461\u24ea"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
-"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"},{"id":"ref-for-idl-DOMString\u2460\u2463"},{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"},{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"},{"id":"ref-for-idl-DOMString\u2462\u2461"},{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"},{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"},{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"},{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"},{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"},{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"},{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
+"87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"},{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2462"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"},{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
+"8841d736": {"dfnID":"8841d736","dfnText":"internal method","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
+"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"},{"id":"ref-for-idl-DOMString\u2460\u2460"},{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"},{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"},{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"},{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"},{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"},{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"},{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"},{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"},{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"},{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"},{"id":"ref-for-idl-DOMString\u2466\u2464"},{"id":"ref-for-idl-DOMString\u2466\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2468"},{"id":"ref-for-idl-DOMString\u2467\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-DOMString\u2467\u2460"},{"id":"ref-for-idl-DOMString\u2467\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
 "889e932f": {"dfnID":"889e932f","dfnText":"Exposed","external":true,"refSections":[{"refs":[{"id":"ref-for-Exposed"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-Exposed\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-Exposed\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-Exposed\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#Exposed"},
-"8958b003": {"dfnID":"8958b003","dfnText":"entry","external":true,"refSections":[{"refs":[{"id":"ref-for-map-entry"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-entry\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-entry"},
-"8a30477b": {"dfnID":"8a30477b","dfnText":"global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-global"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-global\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
-"8c1e3a13": {"dfnID":"8c1e3a13","dfnText":"effective domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-effective-domain"},{"id":"ref-for-concept-origin-effective-domain\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2464"},{"id":"ref-for-concept-origin-effective-domain\u2465"},{"id":"ref-for-concept-origin-effective-domain\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2467"},{"id":"ref-for-concept-origin-effective-domain\u2468"},{"id":"ref-for-concept-origin-effective-domain\u2460\u24ea"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
+"8958b003": {"dfnID":"8958b003","dfnText":"entry","external":true,"refSections":[{"refs":[{"id":"ref-for-map-entry"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-entry\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-entry"},
+"895f19cb": {"dfnID":"895f19cb","dfnText":"Object","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-object"},{"id":"ref-for-dfn-object\u2460"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-object\u2461"},{"id":"ref-for-dfn-object\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-object\u2463"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-object\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-object\u2465"},{"id":"ref-for-dfn-object\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-object"},
+"8a30477b": {"dfnID":"8a30477b","dfnText":"global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-global"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-settings-object-global\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
+"8c1e3a13": {"dfnID":"8c1e3a13","dfnText":"effective domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-effective-domain"},{"id":"ref-for-concept-origin-effective-domain\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2464"},{"id":"ref-for-concept-origin-effective-domain\u2465"},{"id":"ref-for-concept-origin-effective-domain\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2467"},{"id":"ref-for-concept-origin-effective-domain\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u24ea"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2464"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2465"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2468"},{"id":"ref-for-concept-origin-effective-domain\u2461\u24ea"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2461\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
 "8da4d1e3": {"dfnID":"8da4d1e3","dfnText":"invalid argument","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-invalid-argument"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461"},{"id":"ref-for-dfn-invalid-argument\u2462"},{"id":"ref-for-dfn-invalid-argument\u2463"},{"id":"ref-for-dfn-invalid-argument\u2464"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2465"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2466"},{"id":"ref-for-dfn-invalid-argument\u2467"},{"id":"ref-for-dfn-invalid-argument\u2468"},{"id":"ref-for-dfn-invalid-argument\u2460\u24ea"},{"id":"ref-for-dfn-invalid-argument\u2460\u2460"},{"id":"ref-for-dfn-invalid-argument\u2460\u2461"},{"id":"ref-for-dfn-invalid-argument\u2460\u2462"},{"id":"ref-for-dfn-invalid-argument\u2460\u2463"},{"id":"ref-for-dfn-invalid-argument\u2460\u2464"},{"id":"ref-for-dfn-invalid-argument\u2460\u2465"},{"id":"ref-for-dfn-invalid-argument\u2460\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2467"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2468"},{"id":"ref-for-dfn-invalid-argument\u2461\u24ea"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2460"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2461"},{"id":"ref-for-dfn-invalid-argument\u2461\u2462"},{"id":"ref-for-dfn-invalid-argument\u2461\u2463"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2464"},{"id":"ref-for-dfn-invalid-argument\u2461\u2465"},{"id":"ref-for-dfn-invalid-argument\u2461\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-invalid-argument"},
 "8de17130": {"dfnID":"8de17130","dfnText":"valid domain string","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain-string"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain-string\u2460"},{"id":"ref-for-valid-domain-string\u2461"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#valid-domain-string"},
+"8f5c2179": {"dfnID":"8f5c2179","dfnText":"a promise resolved with","external":true,"refSections":[{"refs":[{"id":"ref-for-a-promise-resolved-with"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#a-promise-resolved-with"},
+"902380f7": {"dfnID":"902380f7","dfnText":"credentials mode","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-credentials-mode"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-request-credentials-mode\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://fetch.spec.whatwg.org/#concept-request-credentials-mode"},
 "91748ad6": {"dfnID":"91748ad6","dfnText":"default allowlists","external":true,"refSections":[{"refs":[{"id":"ref-for-policy-controlled-feature-default-allowlist"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist"},
 "944c2033": {"dfnID":"944c2033","dfnText":"credential source","external":true,"refSections":[{"refs":[{"id":"ref-for-credential-source"}],"title":"4. Terminology"}],"url":"https://w3c.github.io/webappsec-credential-management/#credential-source"},
-"94dd0767": {"dfnID":"94dd0767","dfnText":"section 3.3 matcher protection types","external":true,"refSections":[{"refs":[{"id":"ref-for-matcher-protection-types"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types"},
-"984221ca": {"dfnID":"984221ca","dfnText":"struct","external":true,"refSections":[{"refs":[{"id":"ref-for-struct"},{"id":"ref-for-struct\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct\u2463"},{"id":"ref-for-struct\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct\u2465"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"https://infra.spec.whatwg.org/#struct"},
-"99134679": {"dfnID":"99134679","dfnText":"get()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-get"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2463"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2466"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2467"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2468"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2466"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2468"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2462"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2463"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2464"}],"title":"14.6.2. Username Enumeration"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
-"99c988d6": {"dfnID":"99c988d6","dfnText":"remove","external":true,"refSections":[{"refs":[{"id":"ref-for-list-remove"},{"id":"ref-for-list-remove\u2460"},{"id":"ref-for-list-remove\u2461"},{"id":"ref-for-list-remove\u2462"},{"id":"ref-for-list-remove\u2463"},{"id":"ref-for-list-remove\u2464"},{"id":"ref-for-list-remove\u2465"},{"id":"ref-for-list-remove\u2466"},{"id":"ref-for-list-remove\u2467"},{"id":"ref-for-list-remove\u2468"},{"id":"ref-for-list-remove\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2460\u2460"},{"id":"ref-for-list-remove\u2460\u2461"},{"id":"ref-for-list-remove\u2460\u2462"},{"id":"ref-for-list-remove\u2460\u2463"},{"id":"ref-for-list-remove\u2460\u2464"},{"id":"ref-for-list-remove\u2460\u2465"},{"id":"ref-for-list-remove\u2460\u2466"},{"id":"ref-for-list-remove\u2460\u2467"},{"id":"ref-for-list-remove\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2461\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#list-remove"},
-"9aeb0a82": {"dfnID":"9aeb0a82","dfnText":"long long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-long-long"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://webidl.spec.whatwg.org/#idl-long-long"},
+"984221ca": {"dfnID":"984221ca","dfnText":"struct","external":true,"refSections":[{"refs":[{"id":"ref-for-struct"},{"id":"ref-for-struct\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct\u2463"},{"id":"ref-for-struct\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#struct"},
+"99134679": {"dfnID":"99134679","dfnText":"get()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-get"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2463"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2466"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2468"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2465"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2467"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2468"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u24ea"}],"title":"14.6.2. Username Enumeration"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
+"99c988d6": {"dfnID":"99c988d6","dfnText":"remove (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-remove"},{"id":"ref-for-list-remove\u2460"},{"id":"ref-for-list-remove\u2461"},{"id":"ref-for-list-remove\u2462"},{"id":"ref-for-list-remove\u2463"},{"id":"ref-for-list-remove\u2464"},{"id":"ref-for-list-remove\u2465"},{"id":"ref-for-list-remove\u2466"},{"id":"ref-for-list-remove\u2467"},{"id":"ref-for-list-remove\u2468"},{"id":"ref-for-list-remove\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-remove\u2460\u2460"},{"id":"ref-for-list-remove\u2460\u2461"},{"id":"ref-for-list-remove\u2460\u2462"},{"id":"ref-for-list-remove\u2460\u2463"},{"id":"ref-for-list-remove\u2460\u2464"},{"id":"ref-for-list-remove\u2460\u2465"},{"id":"ref-for-list-remove\u2460\u2466"},{"id":"ref-for-list-remove\u2460\u2467"},{"id":"ref-for-list-remove\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-remove\u2461\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#list-remove"},
 "9befea0b": {"dfnID":"9befea0b","dfnText":"EncodingError","external":true,"refSections":[{"refs":[{"id":"ref-for-encodingerror"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-encodingerror\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#encodingerror"},
-"9c4c1e66": {"dfnID":"9c4c1e66","dfnText":"relevant settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-relevant-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relevant-settings-object\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
+"9c4c1e66": {"dfnID":"9c4c1e66","dfnText":"relevant settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-relevant-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-relevant-settings-object\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relevant-settings-object\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
 "9c6c84a4": {"dfnID":"9c6c84a4","dfnText":"application parameter","external":true,"refSections":[{"refs":[{"id":"ref-for-authentication-request-message---u2f_authenticate"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate"},
-"9cce47fd": {"dfnID":"9cce47fd","dfnText":"sequence","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-sequence"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-sequence\u2460"},{"id":"ref-for-idl-sequence\u2461"},{"id":"ref-for-idl-sequence\u2462"},{"id":"ref-for-idl-sequence\u2463"},{"id":"ref-for-idl-sequence\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-sequence\u2465"},{"id":"ref-for-idl-sequence\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-sequence\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-sequence\u2468"},{"id":"ref-for-idl-sequence\u2460\u24ea"},{"id":"ref-for-idl-sequence\u2460\u2460"},{"id":"ref-for-idl-sequence\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2462"},{"id":"ref-for-idl-sequence\u2460\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2465"},{"id":"ref-for-idl-sequence\u2460\u2466"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2467"},{"id":"ref-for-idl-sequence\u2460\u2468"},{"id":"ref-for-idl-sequence\u2461\u24ea"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-sequence"},
-"9cec8893": {"dfnID":"9cec8893","dfnText":"[[Create]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-create-slot"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot"},
-"9d07aa9a": {"dfnID":"9d07aa9a","dfnText":"autocomplete","external":true,"refSections":[{"refs":[{"id":"ref-for-attr-fe-autocomplete"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete"},
+"9cce47fd": {"dfnID":"9cce47fd","dfnText":"sequence","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-sequence"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-sequence\u2460"},{"id":"ref-for-idl-sequence\u2461"},{"id":"ref-for-idl-sequence\u2462"},{"id":"ref-for-idl-sequence\u2463"},{"id":"ref-for-idl-sequence\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-sequence\u2465"},{"id":"ref-for-idl-sequence\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-sequence\u2467"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-idl-sequence\u2468"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u24ea"},{"id":"ref-for-idl-sequence\u2460\u2460"},{"id":"ref-for-idl-sequence\u2460\u2461"},{"id":"ref-for-idl-sequence\u2460\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2463"},{"id":"ref-for-idl-sequence\u2460\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-sequence\u2460\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}],"url":"https://webidl.spec.whatwg.org/#idl-sequence"},
+"9cec8893": {"dfnID":"9cec8893","dfnText":"[[Create]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-create-slot"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credential-create-slot\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot"},
+"9d07aa9a": {"dfnID":"9d07aa9a","dfnText":"autocomplete","external":true,"refSections":[{"refs":[{"id":"ref-for-attr-fe-autocomplete"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete"},
 "9e553618": {"dfnID":"9e553618","dfnText":"language tag","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2.1\u2460"},{"id":"ref-for-section-2.1\u2461"},{"id":"ref-for-section-2.1\u2462"},{"id":"ref-for-section-2.1\u2463"},{"id":"ref-for-section-2.1\u2464"}],"title":"6.4.2. Language and Direction Encoding"}],"url":"https://tools.ietf.org/html/bcp47#section-2.1"},
-"a1c25825": {"dfnID":"a1c25825","dfnText":"opaque host","external":true,"refSections":[{"refs":[{"id":"ref-for-opaque-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-opaque-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#opaque-host"},
+"a1c25825": {"dfnID":"a1c25825","dfnText":"opaque host","external":true,"refSections":[{"refs":[{"id":"ref-for-opaque-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-opaque-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#opaque-host"},
 "a23d12a9": {"dfnID":"a23d12a9","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-scheme"},{"id":"ref-for-concept-origin-scheme\u2460"},{"id":"ref-for-concept-origin-scheme\u2461"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme"},
 "a39b9eaf": {"dfnID":"a39b9eaf","dfnText":"section 7.1","external":true,"refSections":[{"refs":[{"id":"ref-for-section-7.1"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc9053#section-7.1"},
-"a39e599b": {"dfnID":"a39e599b","dfnText":"cose key","external":true,"refSections":[{"refs":[{"id":"ref-for-name-key-objects"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}],"url":"https://tools.ietf.org/html/rfc9052#name-key-objects"},
+"a39e599b": {"dfnID":"a39e599b","dfnText":"COSE key","external":true,"refSections":[{"refs":[{"id":"ref-for-name-key-objects"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}],"url":"https://tools.ietf.org/html/rfc9052#name-key-objects"},
 "a3abdd52": {"dfnID":"a3abdd52","dfnText":"section 2","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2"}],"title":"6.5.1. Attested Credential Data"}],"url":"https://tools.ietf.org/html/rfc9053#section-2"},
-"a3b18719": {"dfnID":"a3b18719","dfnText":"append (for set)","external":true,"refSections":[{"refs":[{"id":"ref-for-set-append"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-set-append\u2460"},{"id":"ref-for-set-append\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-set-append\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-set-append\u2463"},{"id":"ref-for-set-append\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-set-append\u2465"},{"id":"ref-for-set-append\u2466"},{"id":"ref-for-set-append\u2467"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#set-append"},
-"a41102eb": {"dfnID":"a41102eb","dfnText":"permissions policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-permissions-policy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
+"a3b18719": {"dfnID":"a3b18719","dfnText":"append (for set)","external":true,"refSections":[{"refs":[{"id":"ref-for-set-append"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-set-append\u2460"},{"id":"ref-for-set-append\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-set-append\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-set-append\u2463"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-set-append\u2464"},{"id":"ref-for-set-append\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#set-append"},
+"a41102eb": {"dfnID":"a41102eb","dfnText":"permissions policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document-permissions-policy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-concept-document-permissions-policy\u2463"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
 "a5c91173": {"dfnID":"a5c91173","dfnText":"SameObject","external":true,"refSections":[{"refs":[{"id":"ref-for-SameObject"},{"id":"ref-for-SameObject\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-SameObject\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-SameObject\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-SameObject\u2463"},{"id":"ref-for-SameObject\u2464"},{"id":"ref-for-SameObject\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#SameObject"},
-"a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
-"a76569bf": {"dfnID":"a76569bf","dfnText":"is a registrable domain suffix of or is equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"a72449dd": {"dfnID":"a72449dd","dfnText":"in parallel","external":true,"refSections":[{"refs":[{"id":"ref-for-in-parallel"},{"id":"ref-for-in-parallel\u2460"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-in-parallel\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-in-parallel\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-in-parallel\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-in-parallel\u2464"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
+"a76569bf": {"dfnID":"a76569bf","dfnText":"is a registrable domain suffix of or is equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2464"}],"title":"5.11. Using Web Authentication across related origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"a84c14c9": {"dfnID":"a84c14c9","dfnText":"document","external":true,"refSections":[{"refs":[{"id":"ref-for-clone-a-node-document"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-clone-a-node-document\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#clone-a-node-document"},
 "a869e769": {"dfnID":"a869e769","dfnText":"unsupported operation","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-unsupported-operation"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-unsupported-operation"},
-"a944ac4c": {"dfnID":"a944ac4c","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-concept-origin\u2460"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-concept-origin\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin\u2462"},{"id":"ref-for-concept-origin\u2463"},{"id":"ref-for-concept-origin\u2464"},{"id":"ref-for-concept-origin\u2465"},{"id":"ref-for-concept-origin\u2466"},{"id":"ref-for-concept-origin\u2467"},{"id":"ref-for-concept-origin\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-concept-origin\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2462"},{"id":"ref-for-concept-origin\u2460\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2464"},{"id":"ref-for-concept-origin\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
-"a973e0fe": {"dfnID":"a973e0fe","dfnText":"document","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#concept-document"},
+"a944ac4c": {"dfnID":"a944ac4c","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-concept-origin\u2460"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-concept-origin\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin\u2462"},{"id":"ref-for-concept-origin\u2463"},{"id":"ref-for-concept-origin\u2464"},{"id":"ref-for-concept-origin\u2465"},{"id":"ref-for-concept-origin\u2466"},{"id":"ref-for-concept-origin\u2467"},{"id":"ref-for-concept-origin\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-concept-origin\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2462"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2463"},{"id":"ref-for-concept-origin\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2465"},{"id":"ref-for-concept-origin\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
+"aa081c9d": {"dfnID":"aa081c9d","dfnText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-collectfromcredentialstore-slot"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"}],"url":"https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-collectfromcredentialstore-slot"},
 "aa6633ff": {"dfnID":"aa6633ff","dfnText":"multi-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
+"aa747739": {"dfnID":"aa747739","dfnText":"simple exception","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-simple-exception"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dfn-simple-exception\u2460"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://webidl.spec.whatwg.org/#dfn-simple-exception"},
 "aaf09faf": {"dfnID":"aaf09faf","dfnText":"salted","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
-"aaguid": {"dfnID":"aaguid","dfnText":"AAGUID","external":false,"refSections":[{"refs":[{"id":"ref-for-aaguid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-aaguid\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-aaguid\u2461"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-aaguid\u2462"},{"id":"ref-for-aaguid\u2463"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-aaguid\u2464"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-aaguid\u2465"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"#aaguid"},
-"ab309409": {"dfnID":"ab309409","dfnText":"serialize json to bytes","external":true,"refSections":[{"refs":[{"id":"ref-for-serialize-a-javascript-value-to-json-bytes"},{"id":"ref-for-serialize-a-javascript-value-to-json-bytes\u2460"}],"title":"5.8.1.1. Serialization"}],"url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes"},
-"abstract-opdef-create-a-new-supplemental-public-key-record": {"dfnID":"abstract-opdef-create-a-new-supplemental-public-key-record","dfnText":"Create a new supplemental public key record","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-create-a-new-supplemental-public-key-record"},{"id":"ref-for-abstract-opdef-create-a-new-supplemental-public-key-record\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-create-a-new-supplemental-public-key-record"},
+"aaguid": {"dfnID":"aaguid","dfnText":"AAGUID","external":false,"refSections":[{"refs":[{"id":"ref-for-aaguid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-aaguid\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-aaguid\u2461"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-aaguid\u2462"},{"id":"ref-for-aaguid\u2463"}],"title":"16. Test Vectors"}],"url":"#aaguid"},
+"ab309409": {"dfnID":"ab309409","dfnText":"serialize JSON to bytes","external":true,"refSections":[{"refs":[{"id":"ref-for-serialize-a-javascript-value-to-json-bytes"},{"id":"ref-for-serialize-a-javascript-value-to-json-bytes\u2460"}],"title":"5.8.1.1. Serialization"}],"url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes"},
+"abstract-opdef-asynchronous-rp-id-validation-algorithm": {"dfnID":"abstract-opdef-asynchronous-rp-id-validation-algorithm","dfnText":"Asynchronous RP ID validation algorithm","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2461"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2462"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#abstract-opdef-asynchronous-rp-id-validation-algorithm"},
 "abstract-opdef-credential-record-attestationclientdatajson": {"dfnID":"abstract-opdef-credential-record-attestationclientdatajson","dfnText":"attestationClientDataJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationclientdatajson"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-attestationclientdatajson"},
-"abstract-opdef-credential-record-attestationobject": {"dfnID":"abstract-opdef-credential-record-attestationobject","dfnText":"attestationObject","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject\u2461"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"#abstract-opdef-credential-record-attestationobject"},
-"abstract-opdef-credential-record-authenticatordisplayname": {"dfnID":"abstract-opdef-credential-record-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2460"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2461"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#abstract-opdef-credential-record-authenticatordisplayname"},
+"abstract-opdef-credential-record-attestationobject": {"dfnID":"abstract-opdef-credential-record-attestationobject","dfnText":"attestationObject","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject\u2460"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-attestationobject"},
 "abstract-opdef-credential-record-backupeligible": {"dfnID":"abstract-opdef-credential-record-backupeligible","dfnText":"backupEligible","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2461"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupeligible"},
 "abstract-opdef-credential-record-backupstate": {"dfnID":"abstract-opdef-credential-record-backupstate","dfnText":"backupState","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupstate"},
 "abstract-opdef-credential-record-id": {"dfnID":"abstract-opdef-credential-record-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2462"},{"id":"ref-for-abstract-opdef-credential-record-id\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-id"},
 "abstract-opdef-credential-record-publickey": {"dfnID":"abstract-opdef-credential-record-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-publickey"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-publickey\u2460"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-publickey"},
 "abstract-opdef-credential-record-signcount": {"dfnID":"abstract-opdef-credential-record-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-signcount"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-signcount\u2460"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2461"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2462"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2463"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-signcount"},
-"abstract-opdef-credential-record-supplementalpubkeys": {"dfnID":"abstract-opdef-credential-record-supplementalpubkeys","dfnText":"supplementalPubKeys","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2460"},{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2461"},{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2462"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-credential-record-supplementalpubkeys"},
 "abstract-opdef-credential-record-transports": {"dfnID":"abstract-opdef-credential-record-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-transports"},
 "abstract-opdef-credential-record-type": {"dfnID":"abstract-opdef-credential-record-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-type"},
 "abstract-opdef-credential-record-uvinitialized": {"dfnID":"abstract-opdef-credential-record-uvinitialized","dfnText":"uvInitialized","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized"},{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-uvinitialized"},
-"abstract-opdef-supplementalpubkeys-record-aaguid": {"dfnID":"abstract-opdef-supplementalpubkeys-record-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2461"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-aaguid"},
-"abstract-opdef-supplementalpubkeys-record-attstmt": {"dfnID":"abstract-opdef-supplementalpubkeys-record-attstmt","dfnText":"attStmt","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2461"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2462"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-attstmt"},
-"abstract-opdef-supplementalpubkeys-record-fmt": {"dfnID":"abstract-opdef-supplementalpubkeys-record-fmt","dfnText":"fmt","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-fmt"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-fmt\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-fmt"},
-"abstract-opdef-supplementalpubkeys-record-scope": {"dfnID":"abstract-opdef-supplementalpubkeys-record-scope","dfnText":"scope","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-scope"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-scope\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-scope\u2461"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-scope"},
-"abstract-opdef-supplementalpubkeys-record-spk": {"dfnID":"abstract-opdef-supplementalpubkeys-record-spk","dfnText":"spk","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-spk"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2461"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2462"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-spk"},
-"aca22383": {"dfnID":"aca22383","dfnText":"consume user activation","external":true,"refSections":[{"refs":[{"id":"ref-for-consume-user-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation"},
+"abstract-opdef-related-origins-validation-procedure": {"dfnID":"abstract-opdef-related-origins-validation-procedure","dfnText":"related origins validation procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2462"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2463"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"#abstract-opdef-related-origins-validation-procedure"},
+"aca22383": {"dfnID":"aca22383","dfnText":"consume user activation","external":true,"refSections":[{"refs":[{"id":"ref-for-consume-user-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation"},
 "ad09952f": {"dfnID":"ad09952f","dfnText":"[[discovery]]","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discovery-slot"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot"},
 "add-credential": {"dfnID":"add-credential","dfnText":"Add Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-add-credential"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-add-credential\u2460"}],"title":"11.6. Get Credentials"}],"url":"#add-credential"},
 "add-virtual-authenticator": {"dfnID":"add-virtual-authenticator","dfnText":"Add Virtual Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-add-virtual-authenticator"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#add-virtual-authenticator"},
+"ae8def21": {"dfnID":"ae8def21","dfnText":"contain","external":true,"refSections":[{"refs":[{"id":"ref-for-list-contain"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-list-contain\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://infra.spec.whatwg.org/#list-contain"},
 "android-key-attestation-certificate-extension-data": {"dfnID":"android-key-attestation-certificate-extension-data","dfnText":"android key attestation certificate extension\ndata","external":false,"refSections":[{"refs":[{"id":"ref-for-android-key-attestation-certificate-extension-data"},{"id":"ref-for-android-key-attestation-certificate-extension-data\u2460"}],"title":"8.4. Android Key Attestation Statement Format"}],"url":"#android-key-attestation-certificate-extension-data"},
 "anonca": {"dfnID":"anonca","dfnText":"AnonCA","external":false,"refSections":[{"refs":[{"id":"ref-for-anonca"}],"title":"6.5.3. Attestation Types"}],"url":"#anonca"},
-"anonymization-ca": {"dfnID":"anonymization-ca","dfnText":"Anonymization CA","external":false,"refSections":[{"refs":[{"id":"ref-for-anonymization-ca"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-anonymization-ca\u2460"},{"id":"ref-for-anonymization-ca\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-anonymization-ca\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-anonymization-ca\u2463"},{"id":"ref-for-anonymization-ca\u2464"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-anonymization-ca\u2465"},{"id":"ref-for-anonymization-ca\u2466"},{"id":"ref-for-anonymization-ca\u2467"},{"id":"ref-for-anonymization-ca\u2468"}],"title":"14.4.1. Attestation Privacy"}],"url":"#anonymization-ca"},
+"anonymization-ca": {"dfnID":"anonymization-ca","dfnText":"Anonymization CA","external":false,"refSections":[{"refs":[{"id":"ref-for-anonymization-ca"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-anonymization-ca\u2460"},{"id":"ref-for-anonymization-ca\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-anonymization-ca\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-anonymization-ca\u2463"},{"id":"ref-for-anonymization-ca\u2464"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-anonymization-ca\u2465"},{"id":"ref-for-anonymization-ca\u2466"},{"id":"ref-for-anonymization-ca\u2467"},{"id":"ref-for-anonymization-ca\u2468"}],"title":"14.4.1. Attestation Privacy"}],"url":"#anonymization-ca"},
 "appid": {"dfnID":"appid","dfnText":"AppID","external":false,"refSections":[{"refs":[{"id":"ref-for-appid"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-appid\u2460"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#appid"},
-"assertion": {"dfnID":"assertion","dfnText":"Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-assertion"},{"id":"ref-for-assertion\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-assertion\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-assertion\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-assertion\u2463"},{"id":"ref-for-assertion\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-assertion\u2465"},{"id":"ref-for-assertion\u2466"},{"id":"ref-for-assertion\u2467"},{"id":"ref-for-assertion\u2468"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-assertion\u2460\u24ea"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-assertion\u2460\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-assertion\u2460\u2461"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-assertion\u2460\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#assertion"},
-"assertion-signature": {"dfnID":"assertion-signature","dfnText":"assertion signature","external":false,"refSections":[{"refs":[{"id":"ref-for-assertion-signature"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-assertion-signature\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-assertion-signature\u2461"},{"id":"ref-for-assertion-signature\u2462"},{"id":"ref-for-assertion-signature\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-assertion-signature\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-assertion-signature\u2465"},{"id":"ref-for-assertion-signature\u2466"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-assertion-signature\u2467"},{"id":"ref-for-assertion-signature\u2468"},{"id":"ref-for-assertion-signature\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-assertion-signature\u2460\u2460"},{"id":"ref-for-assertion-signature\u2460\u2461"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-assertion-signature\u2460\u2462"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-assertion-signature\u2460\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#assertion-signature"},
-"assertioncreationdata-authenticatordataresult": {"dfnID":"assertioncreationdata-authenticatordataresult","dfnText":"authenticatorDataResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-authenticatordataresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#assertioncreationdata-authenticatordataresult"},
-"assertioncreationdata-clientdatajsonresult": {"dfnID":"assertioncreationdata-clientdatajsonresult","dfnText":"clientDataJSONResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-clientdatajsonresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#assertioncreationdata-clientdatajsonresult"},
-"assertioncreationdata-clientextensionresults": {"dfnID":"assertioncreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-clientextensionresults"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#assertioncreationdata-clientextensionresults"},
-"assertioncreationdata-credentialidresult": {"dfnID":"assertioncreationdata-credentialidresult","dfnText":"credentialIdResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-credentialidresult"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2460"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2461"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#assertioncreationdata-credentialidresult"},
-"assertioncreationdata-signatureresult": {"dfnID":"assertioncreationdata-signatureresult","dfnText":"signatureResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-signatureresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#assertioncreationdata-signatureresult"},
-"assertioncreationdata-userhandleresult": {"dfnID":"assertioncreationdata-userhandleresult","dfnText":"userHandleResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-userhandleresult"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2460"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2461"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2462"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-assertioncreationdata-userhandleresult\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#assertioncreationdata-userhandleresult"},
+"assertion": {"dfnID":"assertion","dfnText":"Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-assertion"},{"id":"ref-for-assertion\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-assertion\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-assertion\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-assertion\u2463"},{"id":"ref-for-assertion\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-assertion\u2465"},{"id":"ref-for-assertion\u2466"},{"id":"ref-for-assertion\u2467"},{"id":"ref-for-assertion\u2468"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-assertion\u2460\u24ea"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-assertion\u2460\u2460"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-assertion\u2460\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#assertion"},
+"assertion-signature": {"dfnID":"assertion-signature","dfnText":"assertion signature","external":false,"refSections":[{"refs":[{"id":"ref-for-assertion-signature"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-assertion-signature\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-assertion-signature\u2461"},{"id":"ref-for-assertion-signature\u2462"},{"id":"ref-for-assertion-signature\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-assertion-signature\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-assertion-signature\u2465"},{"id":"ref-for-assertion-signature\u2466"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-assertion-signature\u2467"},{"id":"ref-for-assertion-signature\u2468"},{"id":"ref-for-assertion-signature\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#assertion-signature"},
+"assertioncreationdata-authenticatordataresult": {"dfnID":"assertioncreationdata-authenticatordataresult","dfnText":"authenticatorDataResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-authenticatordataresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#assertioncreationdata-authenticatordataresult"},
+"assertioncreationdata-clientdatajsonresult": {"dfnID":"assertioncreationdata-clientdatajsonresult","dfnText":"clientDataJSONResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-clientdatajsonresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#assertioncreationdata-clientdatajsonresult"},
+"assertioncreationdata-clientextensionresults": {"dfnID":"assertioncreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-clientextensionresults"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#assertioncreationdata-clientextensionresults"},
+"assertioncreationdata-credentialidresult": {"dfnID":"assertioncreationdata-credentialidresult","dfnText":"credentialIdResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-credentialidresult"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2460"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2461"},{"id":"ref-for-assertioncreationdata-credentialidresult\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#assertioncreationdata-credentialidresult"},
+"assertioncreationdata-signatureresult": {"dfnID":"assertioncreationdata-signatureresult","dfnText":"signatureResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-signatureresult"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#assertioncreationdata-signatureresult"},
+"assertioncreationdata-userhandleresult": {"dfnID":"assertioncreationdata-userhandleresult","dfnText":"userHandleResult","external":false,"refSections":[{"refs":[{"id":"ref-for-assertioncreationdata-userhandleresult"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2460"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2461"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2462"},{"id":"ref-for-assertioncreationdata-userhandleresult\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-assertioncreationdata-userhandleresult\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#assertioncreationdata-userhandleresult"},
 "attca": {"dfnID":"attca","dfnText":"AttCA","external":false,"refSections":[{"refs":[{"id":"ref-for-attca"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attca\u2460"},{"id":"ref-for-attca\u2461"},{"id":"ref-for-attca\u2462"},{"id":"ref-for-attca\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attca\u2464"},{"id":"ref-for-attca\u2465"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attca\u2466"},{"id":"ref-for-attca\u2467"},{"id":"ref-for-attca\u2468"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#attca"},
-"attestation": {"dfnID":"attestation","dfnText":"Attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-attestation\u2462"},{"id":"ref-for-attestation\u2463"},{"id":"ref-for-attestation\u2464"},{"id":"ref-for-attestation\u2465"},{"id":"ref-for-attestation\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation\u2467"},{"id":"ref-for-attestation\u2468"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-attestation\u2460\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation\u2460\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation\u2460\u2461"},{"id":"ref-for-attestation\u2460\u2462"},{"id":"ref-for-attestation\u2460\u2463"},{"id":"ref-for-attestation\u2460\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation\u2460\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation\u2460\u2466"},{"id":"ref-for-attestation\u2460\u2467"},{"id":"ref-for-attestation\u2460\u2468"},{"id":"ref-for-attestation\u2461\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation\u2461\u2460"},{"id":"ref-for-attestation\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation\u2461\u2462"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation\u2461\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation\u2461\u2464"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-attestation\u2461\u2465"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attestation\u2461\u2466"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-attestation\u2461\u2467"}],"title":"13. Security Considerations"}],"url":"#attestation"},
+"attestation": {"dfnID":"attestation","dfnText":"Attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-attestation\u2462"},{"id":"ref-for-attestation\u2463"},{"id":"ref-for-attestation\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation\u2465"},{"id":"ref-for-attestation\u2466"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-attestation\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation\u2468"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation\u2460\u24ea"},{"id":"ref-for-attestation\u2460\u2460"},{"id":"ref-for-attestation\u2460\u2461"},{"id":"ref-for-attestation\u2460\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation\u2460\u2464"},{"id":"ref-for-attestation\u2460\u2465"},{"id":"ref-for-attestation\u2460\u2466"},{"id":"ref-for-attestation\u2460\u2467"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation\u2460\u2468"},{"id":"ref-for-attestation\u2461\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation\u2461\u2460"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation\u2461\u2461"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation\u2461\u2462"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-attestation\u2461\u2463"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-attestation\u2461\u2464"}],"title":"16.1. Attestation trust root certificate"}],"url":"#attestation"},
 "attestation-ca": {"dfnID":"attestation-ca","dfnText":"Attestation CA","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-ca"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-ca\u2460"},{"id":"ref-for-attestation-ca\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-ca\u2462"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-ca"},
-"attestation-certificate": {"dfnID":"attestation-certificate","dfnText":"Attestation Certificate","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-certificate"},{"id":"ref-for-attestation-certificate\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-certificate\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-attestation-certificate\u2462"},{"id":"ref-for-attestation-certificate\u2463"},{"id":"ref-for-attestation-certificate\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-certificate\u2465"}],"title":"8.3.1. TPM Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-attestation-certificate\u2466"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-certificate\u2467"}],"title":"8.4.1. Android Key Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-attestation-certificate\u2468"},{"id":"ref-for-attestation-certificate\u2460\u24ea"},{"id":"ref-for-attestation-certificate\u2460\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2461"},{"id":"ref-for-attestation-certificate\u2460\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2463"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2464"},{"id":"ref-for-attestation-certificate\u2460\u2465"},{"id":"ref-for-attestation-certificate\u2460\u2466"},{"id":"ref-for-attestation-certificate\u2460\u2467"},{"id":"ref-for-attestation-certificate\u2460\u2468"},{"id":"ref-for-attestation-certificate\u2461\u24ea"},{"id":"ref-for-attestation-certificate\u2461\u2460"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-certificate"},
-"attestation-conveyance": {"dfnID":"attestation-conveyance","dfnText":"Attestation Conveyance","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-conveyance"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-conveyance\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation-conveyance\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-conveyance\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-conveyance\u2463"}],"title":"10.2.2.2. Extension Definition"}],"url":"#attestation-conveyance"},
+"attestation-certificate": {"dfnID":"attestation-certificate","dfnText":"Attestation Certificate","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-certificate"},{"id":"ref-for-attestation-certificate\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-certificate\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attestation-certificate\u2462"},{"id":"ref-for-attestation-certificate\u2463"},{"id":"ref-for-attestation-certificate\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-certificate\u2465"},{"id":"ref-for-attestation-certificate\u2466"}],"title":"8.3.1. TPM Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-attestation-certificate\u2467"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-certificate\u2468"}],"title":"8.4.1. Android Key Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u24ea"},{"id":"ref-for-attestation-certificate\u2460\u2460"},{"id":"ref-for-attestation-certificate\u2460\u2461"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2462"},{"id":"ref-for-attestation-certificate\u2460\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-attestation-certificate\u2460\u2465"},{"id":"ref-for-attestation-certificate\u2460\u2466"},{"id":"ref-for-attestation-certificate\u2460\u2467"},{"id":"ref-for-attestation-certificate\u2460\u2468"},{"id":"ref-for-attestation-certificate\u2461\u24ea"},{"id":"ref-for-attestation-certificate\u2461\u2460"},{"id":"ref-for-attestation-certificate\u2461\u2461"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-certificate"},
+"attestation-conveyance": {"dfnID":"attestation-conveyance","dfnText":"Attestation Conveyance","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-conveyance"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-conveyance\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation-conveyance\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-conveyance\u2462"}],"title":"6.5.3. Attestation Types"}],"url":"#attestation-conveyance"},
 "attestation-key-pair": {"dfnID":"attestation-key-pair","dfnText":"attestation key pair","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-key-pair"},{"id":"ref-for-attestation-key-pair\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-key-pair\u2461"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-key-pair\u2462"},{"id":"ref-for-attestation-key-pair\u2463"},{"id":"ref-for-attestation-key-pair\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-key-pair\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-key-pair\u2466"},{"id":"ref-for-attestation-key-pair\u2467"},{"id":"ref-for-attestation-key-pair\u2468"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-key-pair"},
-"attestation-object": {"dfnID":"attestation-object","dfnText":"attestation object","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-object"},{"id":"ref-for-attestation-object\u2460"},{"id":"ref-for-attestation-object\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-object\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-attestation-object\u2463"},{"id":"ref-for-attestation-object\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-object\u2465"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-attestation-object\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation-object\u2467"},{"id":"ref-for-attestation-object\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-object\u2460\u24ea"},{"id":"ref-for-attestation-object\u2460\u2460"},{"id":"ref-for-attestation-object\u2460\u2461"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2463"},{"id":"ref-for-attestation-object\u2460\u2464"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2466"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2467"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2468"},{"id":"ref-for-attestation-object\u2461\u24ea"}],"title":"13.4.4. Attestation Limitations"}],"url":"#attestation-object"},
-"attestation-private-key": {"dfnID":"attestation-private-key","dfnText":"attestation private key","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-private-key"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-private-key\u2460"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-private-key\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-private-key\u2462"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-private-key\u2463"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attestation-private-key\u2464"},{"id":"ref-for-attestation-private-key\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-private-key\u2466"},{"id":"ref-for-attestation-private-key\u2467"},{"id":"ref-for-attestation-private-key\u2468"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-private-key"},
+"attestation-object": {"dfnID":"attestation-object","dfnText":"attestation object","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-object"},{"id":"ref-for-attestation-object\u2460"},{"id":"ref-for-attestation-object\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-object\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-attestation-object\u2463"},{"id":"ref-for-attestation-object\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-object\u2465"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-attestation-object\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-attestation-object\u2467"},{"id":"ref-for-attestation-object\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-object\u2460\u24ea"},{"id":"ref-for-attestation-object\u2460\u2460"},{"id":"ref-for-attestation-object\u2460\u2461"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2463"},{"id":"ref-for-attestation-object\u2460\u2464"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2466"}],"title":"8.2.1. Certificate Requirements for Packed Attestation Statements"},{"refs":[{"id":"ref-for-attestation-object\u2460\u2467"},{"id":"ref-for-attestation-object\u2460\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-attestation-object\u2461\u24ea"},{"id":"ref-for-attestation-object\u2461\u2460"}],"title":"16. Test Vectors"}],"url":"#attestation-object"},
+"attestation-private-key": {"dfnID":"attestation-private-key","dfnText":"attestation private key","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-private-key"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-private-key\u2460"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-private-key\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-private-key\u2462"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-private-key\u2463"},{"id":"ref-for-attestation-private-key\u2464"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-private-key\u2465"},{"id":"ref-for-attestation-private-key\u2466"},{"id":"ref-for-attestation-private-key\u2467"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-attestation-private-key\u2468"}],"title":"16. Test Vectors"}],"url":"#attestation-private-key"},
 "attestation-public-key": {"dfnID":"attestation-public-key","dfnText":"attestation public key","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-public-key"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-public-key\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}],"url":"#attestation-public-key"},
-"attestation-signature": {"dfnID":"attestation-signature","dfnText":"attestation signature","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-signature"},{"id":"ref-for-attestation-signature\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-signature\u2461"},{"id":"ref-for-attestation-signature\u2462"},{"id":"ref-for-attestation-signature\u2463"},{"id":"ref-for-attestation-signature\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-signature\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attestation-signature\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-signature\u2467"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-signature\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u24ea"},{"id":"ref-for-attestation-signature\u2460\u2460"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2461"},{"id":"ref-for-attestation-signature\u2460\u2462"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2463"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2464"},{"id":"ref-for-attestation-signature\u2460\u2465"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2466"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2467"},{"id":"ref-for-attestation-signature\u2460\u2468"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#attestation-signature"},
-"attestation-statement": {"dfnID":"attestation-statement","dfnText":"attestation statement","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement"},{"id":"ref-for-attestation-statement\u2460"},{"id":"ref-for-attestation-statement\u2461"},{"id":"ref-for-attestation-statement\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-statement\u2463"},{"id":"ref-for-attestation-statement\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-attestation-statement\u2465"},{"id":"ref-for-attestation-statement\u2466"},{"id":"ref-for-attestation-statement\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement\u2468"},{"id":"ref-for-attestation-statement\u2460\u24ea"},{"id":"ref-for-attestation-statement\u2460\u2460"},{"id":"ref-for-attestation-statement\u2460\u2461"},{"id":"ref-for-attestation-statement\u2460\u2462"},{"id":"ref-for-attestation-statement\u2460\u2463"},{"id":"ref-for-attestation-statement\u2460\u2464"},{"id":"ref-for-attestation-statement\u2460\u2465"},{"id":"ref-for-attestation-statement\u2460\u2466"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2468"},{"id":"ref-for-attestation-statement\u2461\u24ea"},{"id":"ref-for-attestation-statement\u2461\u2460"},{"id":"ref-for-attestation-statement\u2461\u2461"},{"id":"ref-for-attestation-statement\u2461\u2462"},{"id":"ref-for-attestation-statement\u2461\u2463"},{"id":"ref-for-attestation-statement\u2461\u2464"},{"id":"ref-for-attestation-statement\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement\u2461\u2466"},{"id":"ref-for-attestation-statement\u2461\u2467"},{"id":"ref-for-attestation-statement\u2461\u2468"},{"id":"ref-for-attestation-statement\u2462\u24ea"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2460"},{"id":"ref-for-attestation-statement\u2462\u2461"},{"id":"ref-for-attestation-statement\u2462\u2462"},{"id":"ref-for-attestation-statement\u2462\u2463"},{"id":"ref-for-attestation-statement\u2462\u2464"},{"id":"ref-for-attestation-statement\u2462\u2465"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2467"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2468"},{"id":"ref-for-attestation-statement\u2463\u24ea"},{"id":"ref-for-attestation-statement\u2463\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2461"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2462"},{"id":"ref-for-attestation-statement\u2463\u2463"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2464"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2465"},{"id":"ref-for-attestation-statement\u2463\u2466"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-attestation-statement\u2464\u24ea"},{"id":"ref-for-attestation-statement\u2464\u2460"},{"id":"ref-for-attestation-statement\u2464\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-attestation-statement\u2464\u2462"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#attestation-statement"},
-"attestation-statement-format": {"dfnID":"attestation-statement-format","dfnText":"attestation statement format","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461"},{"id":"ref-for-attestation-statement-format\u2462"},{"id":"ref-for-attestation-statement-format\u2463"},{"id":"ref-for-attestation-statement-format\u2464"},{"id":"ref-for-attestation-statement-format\u2465"},{"id":"ref-for-attestation-statement-format\u2466"},{"id":"ref-for-attestation-statement-format\u2467"},{"id":"ref-for-attestation-statement-format\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u24ea"},{"id":"ref-for-attestation-statement-format\u2460\u2460"},{"id":"ref-for-attestation-statement-format\u2460\u2461"},{"id":"ref-for-attestation-statement-format\u2460\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2464"},{"id":"ref-for-attestation-statement-format\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2466"}],"title":"8.1. Attestation Statement Format Identifiers"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2467"},{"id":"ref-for-attestation-statement-format\u2460\u2468"},{"id":"ref-for-attestation-statement-format\u2461\u24ea"},{"id":"ref-for-attestation-statement-format\u2461\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461\u2461"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461\u2462"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461\u2463"},{"id":"ref-for-attestation-statement-format\u2461\u2464"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#attestation-statement-format"},
+"attestation-signature": {"dfnID":"attestation-signature","dfnText":"attestation signature","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-signature"},{"id":"ref-for-attestation-signature\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-signature\u2461"},{"id":"ref-for-attestation-signature\u2462"},{"id":"ref-for-attestation-signature\u2463"},{"id":"ref-for-attestation-signature\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-signature\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attestation-signature\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-signature\u2467"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-signature\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u24ea"},{"id":"ref-for-attestation-signature\u2460\u2460"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2461"},{"id":"ref-for-attestation-signature\u2460\u2462"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2463"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#attestation-signature"},
+"attestation-statement": {"dfnID":"attestation-statement","dfnText":"attestation statement","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement"},{"id":"ref-for-attestation-statement\u2460"},{"id":"ref-for-attestation-statement\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-statement\u2462"},{"id":"ref-for-attestation-statement\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attestation-statement\u2464"},{"id":"ref-for-attestation-statement\u2465"},{"id":"ref-for-attestation-statement\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement\u2467"},{"id":"ref-for-attestation-statement\u2468"},{"id":"ref-for-attestation-statement\u2460\u24ea"},{"id":"ref-for-attestation-statement\u2460\u2460"},{"id":"ref-for-attestation-statement\u2460\u2461"},{"id":"ref-for-attestation-statement\u2460\u2462"},{"id":"ref-for-attestation-statement\u2460\u2463"},{"id":"ref-for-attestation-statement\u2460\u2464"},{"id":"ref-for-attestation-statement\u2460\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2467"},{"id":"ref-for-attestation-statement\u2460\u2468"},{"id":"ref-for-attestation-statement\u2461\u24ea"},{"id":"ref-for-attestation-statement\u2461\u2460"},{"id":"ref-for-attestation-statement\u2461\u2461"},{"id":"ref-for-attestation-statement\u2461\u2462"},{"id":"ref-for-attestation-statement\u2461\u2463"},{"id":"ref-for-attestation-statement\u2461\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement\u2461\u2465"},{"id":"ref-for-attestation-statement\u2461\u2466"},{"id":"ref-for-attestation-statement\u2461\u2467"},{"id":"ref-for-attestation-statement\u2461\u2468"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u24ea"},{"id":"ref-for-attestation-statement\u2462\u2460"},{"id":"ref-for-attestation-statement\u2462\u2461"},{"id":"ref-for-attestation-statement\u2462\u2462"},{"id":"ref-for-attestation-statement\u2462\u2463"},{"id":"ref-for-attestation-statement\u2462\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2466"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u24ea"},{"id":"ref-for-attestation-statement\u2463\u2460"},{"id":"ref-for-attestation-statement\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2462"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#attestation-statement"},
+"attestation-statement-format": {"dfnID":"attestation-statement-format","dfnText":"attestation statement format","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461"},{"id":"ref-for-attestation-statement-format\u2462"},{"id":"ref-for-attestation-statement-format\u2463"},{"id":"ref-for-attestation-statement-format\u2464"},{"id":"ref-for-attestation-statement-format\u2465"},{"id":"ref-for-attestation-statement-format\u2466"},{"id":"ref-for-attestation-statement-format\u2467"},{"id":"ref-for-attestation-statement-format\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u24ea"},{"id":"ref-for-attestation-statement-format\u2460\u2460"},{"id":"ref-for-attestation-statement-format\u2460\u2461"},{"id":"ref-for-attestation-statement-format\u2460\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2464"},{"id":"ref-for-attestation-statement-format\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2466"}],"title":"8.1. Attestation Statement Format Identifiers"}],"url":"#attestation-statement-format"},
 "attestation-statement-format-identifier": {"dfnID":"attestation-statement-format-identifier","dfnText":"attestation statement format identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format-identifier"},{"id":"ref-for-attestation-statement-format-identifier\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2461"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2462"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2463"}],"title":"8.1. Attestation Statement Format Identifiers"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2464"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#attestation-statement-format-identifier"},
 "attestation-trust-path": {"dfnID":"attestation-trust-path","dfnText":"attestation trust path","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-trust-path"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-trust-path\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-trust-path\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-trust-path\u2462"},{"id":"ref-for-attestation-trust-path\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2464"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2468"}],"title":"8.7. None Attestation Statement Format"}],"url":"#attestation-trust-path"},
 "attestation-type": {"dfnID":"attestation-type","dfnText":"attestation type","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-type"},{"id":"ref-for-attestation-type\u2460"},{"id":"ref-for-attestation-type\u2461"},{"id":"ref-for-attestation-type\u2462"},{"id":"ref-for-attestation-type\u2463"},{"id":"ref-for-attestation-type\u2464"},{"id":"ref-for-attestation-type\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-type\u2466"},{"id":"ref-for-attestation-type\u2467"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-type\u2468"},{"id":"ref-for-attestation-type\u2460\u24ea"},{"id":"ref-for-attestation-type\u2460\u2460"},{"id":"ref-for-attestation-type\u2460\u2461"},{"id":"ref-for-attestation-type\u2460\u2462"},{"id":"ref-for-attestation-type\u2460\u2463"},{"id":"ref-for-attestation-type\u2460\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2466"},{"id":"ref-for-attestation-type\u2460\u2467"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2468"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2463"},{"id":"ref-for-attestation-type\u2461\u2464"}],"title":"13.4.4. Attestation Limitations"}],"url":"#attestation-type"},
-"attested-credential-data": {"dfnID":"attested-credential-data","dfnText":"Attested credential data","external":false,"refSections":[{"refs":[{"id":"ref-for-attested-credential-data"},{"id":"ref-for-attested-credential-data\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-attested-credential-data\u2461"},{"id":"ref-for-attested-credential-data\u2462"},{"id":"ref-for-attested-credential-data\u2463"},{"id":"ref-for-attested-credential-data\u2464"},{"id":"ref-for-attested-credential-data\u2465"},{"id":"ref-for-attested-credential-data\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attested-credential-data\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attested-credential-data\u2468"},{"id":"ref-for-attested-credential-data\u2460\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u2460"},{"id":"ref-for-attested-credential-data\u2460\u2461"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u2462"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u2463"}],"title":"10.2.2.2.1. AAGUIDs"}],"url":"#attested-credential-data"},
-"authdata-attestedcredentialdata": {"dfnID":"authdata-attestedcredentialdata","dfnText":"attestedCredentialData","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2461"},{"id":"ref-for-authdata-attestedcredentialdata\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2463"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460\u24ea"},{"id":"ref-for-authdata-attestedcredentialdata\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata"},
-"authdata-attestedcredentialdata-aaguid": {"dfnID":"authdata-attestedcredentialdata-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2464"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2465"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2466"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2467"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"#authdata-attestedcredentialdata-aaguid"},
-"authdata-attestedcredentialdata-credentialid": {"dfnID":"authdata-attestedcredentialdata-credentialid","dfnText":"credentialId","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2463"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2464"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#authdata-attestedcredentialdata-credentialid"},
+"attested-credential-data": {"dfnID":"attested-credential-data","dfnText":"Attested credential data","external":false,"refSections":[{"refs":[{"id":"ref-for-attested-credential-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attested-credential-data\u2460"},{"id":"ref-for-attested-credential-data\u2461"},{"id":"ref-for-attested-credential-data\u2462"},{"id":"ref-for-attested-credential-data\u2463"},{"id":"ref-for-attested-credential-data\u2464"},{"id":"ref-for-attested-credential-data\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attested-credential-data\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attested-credential-data\u2467"},{"id":"ref-for-attested-credential-data\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u24ea"},{"id":"ref-for-attested-credential-data\u2460\u2460"}],"title":"6.5.1. Attested Credential Data"}],"url":"#attested-credential-data"},
+"authdata-attestedcredentialdata": {"dfnID":"authdata-attestedcredentialdata","dfnText":"attestedCredentialData","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2461"},{"id":"ref-for-authdata-attestedcredentialdata\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2463"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460\u24ea"},{"id":"ref-for-authdata-attestedcredentialdata\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata"},
+"authdata-attestedcredentialdata-aaguid": {"dfnID":"authdata-attestedcredentialdata-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2464"}],"title":"8.3. TPM Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-aaguid"},
+"authdata-attestedcredentialdata-credentialid": {"dfnID":"authdata-attestedcredentialdata-credentialid","dfnText":"credentialId","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2463"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2464"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#authdata-attestedcredentialdata-credentialid"},
 "authdata-attestedcredentialdata-credentialidlength": {"dfnID":"authdata-attestedcredentialdata-credentialidlength","dfnText":"credentialIdLength","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength"},{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength\u2460"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-attestedcredentialdata-credentialidlength"},
-"authdata-attestedcredentialdata-credentialpublickey": {"dfnID":"authdata-attestedcredentialdata-credentialpublickey","dfnText":"credentialPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2468"}],"title":"10.2.2.2. Extension Definition"}],"url":"#authdata-attestedcredentialdata-credentialpublickey"},
+"authdata-attestedcredentialdata-credentialpublickey": {"dfnID":"authdata-attestedcredentialdata-credentialpublickey","dfnText":"credentialPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}],"title":"8.4. Android Key Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-credentialpublickey"},
 "authdata-extensions": {"dfnID":"authdata-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-extensions"},{"id":"ref-for-authdata-extensions\u2460"},{"id":"ref-for-authdata-extensions\u2461"},{"id":"ref-for-authdata-extensions\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-extensions\u2463"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-extensions\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authdata-extensions\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authdata-extensions\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-extensions\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-extensions\u2468"},{"id":"ref-for-authdata-extensions\u2460\u24ea"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#authdata-extensions"},
-"authdata-flags": {"dfnID":"authdata-flags","dfnText":"flags","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags"},{"id":"ref-for-authdata-flags\u2460"},{"id":"ref-for-authdata-flags\u2461"},{"id":"ref-for-authdata-flags\u2462"},{"id":"ref-for-authdata-flags\u2463"},{"id":"ref-for-authdata-flags\u2464"},{"id":"ref-for-authdata-flags\u2465"},{"id":"ref-for-authdata-flags\u2466"},{"id":"ref-for-authdata-flags\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags\u2468"},{"id":"ref-for-authdata-flags\u2460\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags\u2460\u2460"},{"id":"ref-for-authdata-flags\u2460\u2461"},{"id":"ref-for-authdata-flags\u2460\u2462"},{"id":"ref-for-authdata-flags\u2460\u2463"},{"id":"ref-for-authdata-flags\u2460\u2464"},{"id":"ref-for-authdata-flags\u2460\u2465"},{"id":"ref-for-authdata-flags\u2460\u2466"},{"id":"ref-for-authdata-flags\u2460\u2467"},{"id":"ref-for-authdata-flags\u2460\u2468"},{"id":"ref-for-authdata-flags\u2461\u24ea"},{"id":"ref-for-authdata-flags\u2461\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2461"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2462"},{"id":"ref-for-authdata-flags\u2461\u2463"},{"id":"ref-for-authdata-flags\u2461\u2464"},{"id":"ref-for-authdata-flags\u2461\u2465"},{"id":"ref-for-authdata-flags\u2461\u2466"},{"id":"ref-for-authdata-flags\u2461\u2467"},{"id":"ref-for-authdata-flags\u2461\u2468"},{"id":"ref-for-authdata-flags\u2462\u24ea"},{"id":"ref-for-authdata-flags\u2462\u2460"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2461"},{"id":"ref-for-authdata-flags\u2462\u2462"},{"id":"ref-for-authdata-flags\u2462\u2463"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2464"},{"id":"ref-for-authdata-flags\u2462\u2465"},{"id":"ref-for-authdata-flags\u2462\u2466"},{"id":"ref-for-authdata-flags\u2462\u2467"},{"id":"ref-for-authdata-flags\u2462\u2468"},{"id":"ref-for-authdata-flags\u2463\u24ea"},{"id":"ref-for-authdata-flags\u2463\u2460"},{"id":"ref-for-authdata-flags\u2463\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2463\u2462"},{"id":"ref-for-authdata-flags\u2463\u2463"},{"id":"ref-for-authdata-flags\u2463\u2464"},{"id":"ref-for-authdata-flags\u2463\u2465"},{"id":"ref-for-authdata-flags\u2463\u2466"},{"id":"ref-for-authdata-flags\u2463\u2467"},{"id":"ref-for-authdata-flags\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u24ea"},{"id":"ref-for-authdata-flags\u2464\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2461"},{"id":"ref-for-authdata-flags\u2464\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags"},
+"authdata-flags": {"dfnID":"authdata-flags","dfnText":"flags","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags"},{"id":"ref-for-authdata-flags\u2460"},{"id":"ref-for-authdata-flags\u2461"},{"id":"ref-for-authdata-flags\u2462"},{"id":"ref-for-authdata-flags\u2463"},{"id":"ref-for-authdata-flags\u2464"},{"id":"ref-for-authdata-flags\u2465"},{"id":"ref-for-authdata-flags\u2466"},{"id":"ref-for-authdata-flags\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags\u2468"},{"id":"ref-for-authdata-flags\u2460\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags\u2460\u2460"},{"id":"ref-for-authdata-flags\u2460\u2461"},{"id":"ref-for-authdata-flags\u2460\u2462"},{"id":"ref-for-authdata-flags\u2460\u2463"},{"id":"ref-for-authdata-flags\u2460\u2464"},{"id":"ref-for-authdata-flags\u2460\u2465"},{"id":"ref-for-authdata-flags\u2460\u2466"},{"id":"ref-for-authdata-flags\u2460\u2467"},{"id":"ref-for-authdata-flags\u2460\u2468"},{"id":"ref-for-authdata-flags\u2461\u24ea"},{"id":"ref-for-authdata-flags\u2461\u2460"},{"id":"ref-for-authdata-flags\u2461\u2461"},{"id":"ref-for-authdata-flags\u2461\u2462"},{"id":"ref-for-authdata-flags\u2461\u2463"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2464"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2465"},{"id":"ref-for-authdata-flags\u2461\u2466"},{"id":"ref-for-authdata-flags\u2461\u2467"},{"id":"ref-for-authdata-flags\u2461\u2468"},{"id":"ref-for-authdata-flags\u2462\u24ea"},{"id":"ref-for-authdata-flags\u2462\u2460"},{"id":"ref-for-authdata-flags\u2462\u2461"},{"id":"ref-for-authdata-flags\u2462\u2462"},{"id":"ref-for-authdata-flags\u2462\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2464"},{"id":"ref-for-authdata-flags\u2462\u2465"},{"id":"ref-for-authdata-flags\u2462\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2467"},{"id":"ref-for-authdata-flags\u2462\u2468"},{"id":"ref-for-authdata-flags\u2463\u24ea"},{"id":"ref-for-authdata-flags\u2463\u2460"},{"id":"ref-for-authdata-flags\u2463\u2461"},{"id":"ref-for-authdata-flags\u2463\u2462"},{"id":"ref-for-authdata-flags\u2463\u2463"},{"id":"ref-for-authdata-flags\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2463\u2465"},{"id":"ref-for-authdata-flags\u2463\u2466"},{"id":"ref-for-authdata-flags\u2463\u2467"},{"id":"ref-for-authdata-flags\u2463\u2468"},{"id":"ref-for-authdata-flags\u2464\u24ea"},{"id":"ref-for-authdata-flags\u2464\u2460"},{"id":"ref-for-authdata-flags\u2464\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2462"},{"id":"ref-for-authdata-flags\u2464\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2464"},{"id":"ref-for-authdata-flags\u2464\u2465"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags"},
 "authdata-flags-at": {"dfnID":"authdata-flags-at","dfnText":"AT","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-at"},{"id":"ref-for-authdata-flags-at\u2460"},{"id":"ref-for-authdata-flags-at\u2461"},{"id":"ref-for-authdata-flags-at\u2462"},{"id":"ref-for-authdata-flags-at\u2463"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-flags-at"},
-"authdata-flags-be": {"dfnID":"authdata-flags-be","dfnText":"BE","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-be"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460"},{"id":"ref-for-authdata-flags-be\u2461"},{"id":"ref-for-authdata-flags-be\u2462"},{"id":"ref-for-authdata-flags-be\u2463"},{"id":"ref-for-authdata-flags-be\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-be\u2465"},{"id":"ref-for-authdata-flags-be\u2466"},{"id":"ref-for-authdata-flags-be\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-be\u2468"},{"id":"ref-for-authdata-flags-be\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2461"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-be"},
-"authdata-flags-bs": {"dfnID":"authdata-flags-bs","dfnText":"BS","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-bs"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460"},{"id":"ref-for-authdata-flags-bs\u2461"},{"id":"ref-for-authdata-flags-bs\u2462"},{"id":"ref-for-authdata-flags-bs\u2463"},{"id":"ref-for-authdata-flags-bs\u2464"},{"id":"ref-for-authdata-flags-bs\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2466"},{"id":"ref-for-authdata-flags-bs\u2467"},{"id":"ref-for-authdata-flags-bs\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u24ea"},{"id":"ref-for-authdata-flags-bs\u2460\u2460"},{"id":"ref-for-authdata-flags-bs\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2462"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2463"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-bs"},
+"authdata-flags-be": {"dfnID":"authdata-flags-be","dfnText":"BE","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-be"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-be\u2461"},{"id":"ref-for-authdata-flags-be\u2462"},{"id":"ref-for-authdata-flags-be\u2463"},{"id":"ref-for-authdata-flags-be\u2464"},{"id":"ref-for-authdata-flags-be\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-be\u2466"},{"id":"ref-for-authdata-flags-be\u2467"},{"id":"ref-for-authdata-flags-be\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u24ea"},{"id":"ref-for-authdata-flags-be\u2460\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2462"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-be"},
+"authdata-flags-bs": {"dfnID":"authdata-flags-bs","dfnText":"BS","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-bs"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460"},{"id":"ref-for-authdata-flags-bs\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2462"},{"id":"ref-for-authdata-flags-bs\u2463"},{"id":"ref-for-authdata-flags-bs\u2464"},{"id":"ref-for-authdata-flags-bs\u2465"},{"id":"ref-for-authdata-flags-bs\u2466"},{"id":"ref-for-authdata-flags-bs\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2468"},{"id":"ref-for-authdata-flags-bs\u2460\u24ea"},{"id":"ref-for-authdata-flags-bs\u2460\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2461"},{"id":"ref-for-authdata-flags-bs\u2460\u2462"},{"id":"ref-for-authdata-flags-bs\u2460\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2465"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-bs"},
 "authdata-flags-ed": {"dfnID":"authdata-flags-ed","dfnText":"ED","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-ed"},{"id":"ref-for-authdata-flags-ed\u2460"},{"id":"ref-for-authdata-flags-ed\u2461"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-flags-ed"},
 "authdata-flags-up": {"dfnID":"authdata-flags-up","dfnText":"UP","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-up"},{"id":"ref-for-authdata-flags-up\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-up\u2461"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags-up\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-up\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-flags-up"},
 "authdata-flags-uv": {"dfnID":"authdata-flags-uv","dfnText":"UV","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-uv"},{"id":"ref-for-authdata-flags-uv\u2460"},{"id":"ref-for-authdata-flags-uv\u2461"},{"id":"ref-for-authdata-flags-uv\u2462"},{"id":"ref-for-authdata-flags-uv\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2464"},{"id":"ref-for-authdata-flags-uv\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2466"},{"id":"ref-for-authdata-flags-uv\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2468"},{"id":"ref-for-authdata-flags-uv\u2460\u24ea"},{"id":"ref-for-authdata-flags-uv\u2460\u2460"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2461"},{"id":"ref-for-authdata-flags-uv\u2460\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2463"},{"id":"ref-for-authdata-flags-uv\u2460\u2464"},{"id":"ref-for-authdata-flags-uv\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags-uv"},
 "authdata-rpidhash": {"dfnID":"authdata-rpidhash","dfnText":"rpIdHash","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-rpidhash"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-rpidhash\u2460"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-rpidhash\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-rpidhash\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-rpidhash\u2463"},{"id":"ref-for-authdata-rpidhash\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#authdata-rpidhash"},
 "authdata-signcount": {"dfnID":"authdata-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-signcount"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-signcount\u2460"},{"id":"ref-for-authdata-signcount\u2461"},{"id":"ref-for-authdata-signcount\u2462"},{"id":"ref-for-authdata-signcount\u2463"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authdata-signcount\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-signcount\u2465"},{"id":"ref-for-authdata-signcount\u2466"},{"id":"ref-for-authdata-signcount\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-signcount"},
-"authentication": {"dfnID":"authentication","dfnText":"Authentication","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication"},{"id":"ref-for-authentication\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authentication\u2462"},{"id":"ref-for-authentication\u2463"},{"id":"ref-for-authentication\u2464"},{"id":"ref-for-authentication\u2465"},{"id":"ref-for-authentication\u2466"},{"id":"ref-for-authentication\u2467"},{"id":"ref-for-authentication\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authentication\u2460\u2460"},{"id":"ref-for-authentication\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication\u2460\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authentication\u2460\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authentication\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authentication\u2460\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication\u2460\u2468"}],"title":"16. Acknowledgements"}],"url":"#authentication"},
-"authentication-assertion": {"dfnID":"authentication-assertion","dfnText":"Authentication Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-assertion"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication-assertion\u2460"},{"id":"ref-for-authentication-assertion\u2461"},{"id":"ref-for-authentication-assertion\u2462"},{"id":"ref-for-authentication-assertion\u2463"},{"id":"ref-for-authentication-assertion\u2464"},{"id":"ref-for-authentication-assertion\u2465"},{"id":"ref-for-authentication-assertion\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-assertion\u2467"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-assertion\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2464"},{"id":"ref-for-authentication-assertion\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#authentication-assertion"},
-"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2462"},{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"},{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"},{"id":"ref-for-authentication-ceremony\u2461\u2465"},{"id":"ref-for-authentication-ceremony\u2461\u2466"},{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"},{"id":"ref-for-authentication-ceremony\u2462\u24ea"},{"id":"ref-for-authentication-ceremony\u2462\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2463"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2466"},{"id":"ref-for-authentication-ceremony\u2462\u2467"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"},{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"},{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"},{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
-"authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2460"},{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"},{"id":"ref-for-authentication-extension\u2460\u2467"},{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u24ea"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2460"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2461"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2462"},{"id":"ref-for-authentication-extension\u2461\u2463"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
+"authentication": {"dfnID":"authentication","dfnText":"Authentication","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication"},{"id":"ref-for-authentication\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authentication\u2462"},{"id":"ref-for-authentication\u2463"},{"id":"ref-for-authentication\u2464"},{"id":"ref-for-authentication\u2465"},{"id":"ref-for-authentication\u2466"},{"id":"ref-for-authentication\u2467"},{"id":"ref-for-authentication\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authentication\u2460\u2460"},{"id":"ref-for-authentication\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication\u2460\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authentication\u2460\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authentication\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authentication\u2460\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication\u2460\u2468"}],"title":"17. Acknowledgements"}],"url":"#authentication"},
+"authentication-assertion": {"dfnID":"authentication-assertion","dfnText":"Authentication Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-assertion"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication-assertion\u2460"},{"id":"ref-for-authentication-assertion\u2461"},{"id":"ref-for-authentication-assertion\u2462"},{"id":"ref-for-authentication-assertion\u2463"},{"id":"ref-for-authentication-assertion\u2464"},{"id":"ref-for-authentication-assertion\u2465"},{"id":"ref-for-authentication-assertion\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-assertion\u2467"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-assertion\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2464"},{"id":"ref-for-authentication-assertion\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#authentication-assertion"},
+"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2468"},{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2463"},{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"},{"id":"ref-for-authentication-ceremony\u2463\u2466"},{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"},{"id":"ref-for-authentication-ceremony\u2464\u24ea"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2462"}],"title":"15.1. Recommended Range for Ceremony Timeouts"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"16. Test Vectors"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"}],"title":"16.1.1. ES256 Credential with No Attestation"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2465"}],"title":"16.1.2. ES256 Credential with Self Attestation"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2466"}],"title":"16.1.3. ES256 Credential with \"crossOrigin\": true in clientDataJSON"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2467"}],"title":"16.1.4. ES256 Credential with \"topOrigin\" in clientDataJSON"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2468"}],"title":"16.1.5. ES256 Credential with very long credential ID"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u24ea"}],"title":"16.1.6. Packed Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2460"}],"title":"16.1.7. Packed Attestation with ES384 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2461"}],"title":"16.1.8. Packed Attestation with ES512 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2462"}],"title":"16.1.9. Packed Attestation with RS256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2463"}],"title":"16.1.10. Packed Attestation with Ed25519 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2464"}],"title":"16.1.11. TPM Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2465"}],"title":"16.1.12. Android Key Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2466"}],"title":"16.1.13. Apple Anonymous Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2467"}],"title":"16.1.14. FIDO U2F Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-authentication-ceremony\u2465\u2468"},{"id":"ref-for-authentication-ceremony\u2466\u24ea"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#authentication-ceremony"},
+"authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"},{"id":"ref-for-authentication-extension\u2460\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"},{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2467"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
 "authentication-factor-capability": {"dfnID":"authentication-factor-capability","dfnText":"Authentication Factor Capability","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-factor-capability"},{"id":"ref-for-authentication-factor-capability\u2460"},{"id":"ref-for-authentication-factor-capability\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authentication-factor-capability"},
-"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"},{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2463"},{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2461"},{"id":"ref-for-authenticator\u2468\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2468\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"},{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"},{"id":"ref-for-authenticator\u2460\u24ea\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2466"},{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2462"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2464"},{"id":"ref-for-authenticator\u2460\u2461\u2465"},{"id":"ref-for-authenticator\u2460\u2461\u2466"},{"id":"ref-for-authenticator\u2460\u2461\u2467"},{"id":"ref-for-authenticator\u2460\u2461\u2468"},{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2461"},{"id":"ref-for-authenticator\u2460\u2462\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"},{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2460"},{"id":"ref-for-authenticator\u2460\u2463\u2461"},{"id":"ref-for-authenticator\u2460\u2463\u2462"},{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"},{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"},{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"},{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"},{"id":"ref-for-authenticator\u2460\u2465\u24ea"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"},{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"},{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"},{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2463"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"},{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2460"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2461"},{"id":"ref-for-authenticator\u2461\u24ea\u2462"},{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"},{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2463"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2464"},{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"},{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u2461\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"},{"id":"ref-for-authenticator\u2461\u2461\u2462"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2467"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u24ea"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"},{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"},{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"},{"id":"ref-for-authenticator\u2461\u2463\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2465"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2466"},{"id":"ref-for-authenticator\u2461\u2463\u2467"},{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"},{"id":"ref-for-authenticator\u2461\u2464\u2460"},{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"},{"id":"ref-for-authenticator\u2461\u2464\u2464"},{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"},{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2461"},{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"},{"id":"ref-for-authenticator\u2461\u2466\u2460"},{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2466"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"},{"id":"ref-for-authenticator\u2461\u2467\u2461"},{"id":"ref-for-authenticator\u2461\u2467\u2462"},{"id":"ref-for-authenticator\u2461\u2467\u2463"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"},{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"},{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u24ea"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"},{"id":"ref-for-authenticator\u2462\u24ea\u2463"},{"id":"ref-for-authenticator\u2462\u24ea\u2464"},{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2463"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"},{"id":"ref-for-authenticator\u2462\u2460\u2467"},{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"},{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2462\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
-"authenticator-attachment-modality": {"dfnID":"authenticator-attachment-modality","dfnText":"Authenticator Attachment Modality","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-attachment-modality"},{"id":"ref-for-authenticator-attachment-modality\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2465"},{"id":"ref-for-authenticator-attachment-modality\u2466"},{"id":"ref-for-authenticator-attachment-modality\u2467"},{"id":"ref-for-authenticator-attachment-modality\u2468"},{"id":"ref-for-authenticator-attachment-modality\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2460\u2460"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-attachment-modality"},
+"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"},{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"},{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"},{"id":"ref-for-authenticator\u2461\u2465\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"},{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"},{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2468"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u24ea"},{"id":"ref-for-authenticator\u2461\u2466\u2460"},{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u24ea"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"},{"id":"ref-for-authenticator\u2461\u2467\u2462"},{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"},{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2465"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2466"},{"id":"ref-for-authenticator\u2461\u2468\u2467"},{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2461"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"},{"id":"ref-for-authenticator\u2462\u24ea\u2464"},{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"},{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"},{"id":"ref-for-authenticator\u2462\u2460\u2468"},{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"},{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"},{"id":"ref-for-authenticator\u2462\u2463\u24ea"},{"id":"ref-for-authenticator\u2462\u2463\u2460"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2461"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2462"},{"id":"ref-for-authenticator\u2462\u2463\u2463"},{"id":"ref-for-authenticator\u2462\u2463\u2464"},{"id":"ref-for-authenticator\u2462\u2463\u2465"},{"id":"ref-for-authenticator\u2462\u2463\u2466"}],"title":"16. Test Vectors"}],"url":"#authenticator"},
+"authenticator-attachment-modality": {"dfnID":"authenticator-attachment-modality","dfnText":"Authenticator Attachment Modality","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-attachment-modality"},{"id":"ref-for-authenticator-attachment-modality\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2465"},{"id":"ref-for-authenticator-attachment-modality\u2466"},{"id":"ref-for-authenticator-attachment-modality\u2467"},{"id":"ref-for-authenticator-attachment-modality\u2468"},{"id":"ref-for-authenticator-attachment-modality\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2460\u2460"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-attachment-modality"},
 "authenticator-configuration": {"dfnID":"authenticator-configuration","dfnText":"Authenticator Configuration","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-configuration"},{"id":"ref-for-authenticator-configuration\u2460"},{"id":"ref-for-authenticator-configuration\u2461"},{"id":"ref-for-authenticator-configuration\u2462"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticator-configuration"},
-"authenticator-credentials-map": {"dfnID":"authenticator-credentials-map","dfnText":"credentials map","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-credentials-map"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#authenticator-credentials-map"},
-"authenticator-data": {"dfnID":"authenticator-data","dfnText":"authenticator data","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-data"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator-data\u2460"},{"id":"ref-for-authenticator-data\u2461"},{"id":"ref-for-authenticator-data\u2462"},{"id":"ref-for-authenticator-data\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-data\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-data\u2465"},{"id":"ref-for-authenticator-data\u2466"},{"id":"ref-for-authenticator-data\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator-data\u2468"},{"id":"ref-for-authenticator-data\u2460\u24ea"},{"id":"ref-for-authenticator-data\u2460\u2460"},{"id":"ref-for-authenticator-data\u2460\u2461"},{"id":"ref-for-authenticator-data\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2465"},{"id":"ref-for-authenticator-data\u2460\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2467"},{"id":"ref-for-authenticator-data\u2460\u2468"},{"id":"ref-for-authenticator-data\u2461\u24ea"},{"id":"ref-for-authenticator-data\u2461\u2460"},{"id":"ref-for-authenticator-data\u2461\u2461"},{"id":"ref-for-authenticator-data\u2461\u2462"},{"id":"ref-for-authenticator-data\u2461\u2463"},{"id":"ref-for-authenticator-data\u2461\u2464"},{"id":"ref-for-authenticator-data\u2461\u2465"},{"id":"ref-for-authenticator-data\u2461\u2466"},{"id":"ref-for-authenticator-data\u2461\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator-data\u2461\u2468"},{"id":"ref-for-authenticator-data\u2462\u24ea"},{"id":"ref-for-authenticator-data\u2462\u2460"},{"id":"ref-for-authenticator-data\u2462\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2462"},{"id":"ref-for-authenticator-data\u2462\u2463"},{"id":"ref-for-authenticator-data\u2462\u2464"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2468"},{"id":"ref-for-authenticator-data\u2463\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2461"},{"id":"ref-for-authenticator-data\u2463\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2465"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2466"},{"id":"ref-for-authenticator-data\u2463\u2467"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2468"},{"id":"ref-for-authenticator-data\u2464\u24ea"},{"id":"ref-for-authenticator-data\u2464\u2460"},{"id":"ref-for-authenticator-data\u2464\u2461"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2462"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2463"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2464"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2465"},{"id":"ref-for-authenticator-data\u2464\u2466"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2467"},{"id":"ref-for-authenticator-data\u2464\u2468"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authenticator-data\u2465\u24ea"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator-data\u2465\u2460"}],"title":"13.3.1. Attestation Certificate Hierarchy"}],"url":"#authenticator-data"},
+"authenticator-credentials-map": {"dfnID":"authenticator-credentials-map","dfnText":"credentials map","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-credentials-map"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2461"},{"id":"ref-for-authenticator-credentials-map\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2463"},{"id":"ref-for-authenticator-credentials-map\u2464"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2465"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2466"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460\u24ea"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#authenticator-credentials-map"},
+"authenticator-data": {"dfnID":"authenticator-data","dfnText":"authenticator data","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-data"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator-data\u2460"},{"id":"ref-for-authenticator-data\u2461"},{"id":"ref-for-authenticator-data\u2462"},{"id":"ref-for-authenticator-data\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-data\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-data\u2465"},{"id":"ref-for-authenticator-data\u2466"},{"id":"ref-for-authenticator-data\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator-data\u2468"},{"id":"ref-for-authenticator-data\u2460\u24ea"},{"id":"ref-for-authenticator-data\u2460\u2460"},{"id":"ref-for-authenticator-data\u2460\u2461"},{"id":"ref-for-authenticator-data\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2465"},{"id":"ref-for-authenticator-data\u2460\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator-data\u2460\u2467"},{"id":"ref-for-authenticator-data\u2460\u2468"},{"id":"ref-for-authenticator-data\u2461\u24ea"},{"id":"ref-for-authenticator-data\u2461\u2460"},{"id":"ref-for-authenticator-data\u2461\u2461"},{"id":"ref-for-authenticator-data\u2461\u2462"},{"id":"ref-for-authenticator-data\u2461\u2463"},{"id":"ref-for-authenticator-data\u2461\u2464"},{"id":"ref-for-authenticator-data\u2461\u2465"},{"id":"ref-for-authenticator-data\u2461\u2466"},{"id":"ref-for-authenticator-data\u2461\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator-data\u2461\u2468"},{"id":"ref-for-authenticator-data\u2462\u24ea"},{"id":"ref-for-authenticator-data\u2462\u2460"},{"id":"ref-for-authenticator-data\u2462\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2462"},{"id":"ref-for-authenticator-data\u2462\u2463"},{"id":"ref-for-authenticator-data\u2462\u2464"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-data\u2462\u2468"},{"id":"ref-for-authenticator-data\u2463\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2461"},{"id":"ref-for-authenticator-data\u2463\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2465"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2466"},{"id":"ref-for-authenticator-data\u2463\u2467"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-data\u2463\u2468"},{"id":"ref-for-authenticator-data\u2464\u24ea"},{"id":"ref-for-authenticator-data\u2464\u2460"},{"id":"ref-for-authenticator-data\u2464\u2461"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2462"},{"id":"ref-for-authenticator-data\u2464\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2464"},{"id":"ref-for-authenticator-data\u2464\u2465"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2466"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator-data\u2464\u2467"}],"title":"13.3.1. Attestation Certificate Hierarchy"}],"url":"#authenticator-data"},
 "authenticator-data-claimed-to-have-been-used-for-the-attestation": {"dfnID":"authenticator-data-claimed-to-have-been-used-for-the-attestation","dfnText":"authenticator data claimed to have been used for the attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation"}],"title":"8.4. Android Key Attestation Statement Format"}],"url":"#authenticator-data-claimed-to-have-been-used-for-the-attestation"},
 "authenticator-data-for-the-attestation": {"dfnID":"authenticator-data-for-the-attestation","dfnText":"authenticator data\nfor the attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-data-for-the-attestation"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data-for-the-attestation\u2460"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data-for-the-attestation\u2461"},{"id":"ref-for-authenticator-data-for-the-attestation\u2462"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data-for-the-attestation\u2463"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator-data-for-the-attestation\u2464"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#authenticator-data-for-the-attestation"},
 "authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure": {"dfnID":"authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure","dfnText":"perform the following steps to generate an authenticator data structure","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure"},
-"authenticator-extension": {"dfnID":"authenticator-extension","dfnText":"authenticator extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-extension\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator-extension\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-extension\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator-extension\u2464"},{"id":"ref-for-authenticator-extension\u2465"},{"id":"ref-for-authenticator-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2467"},{"id":"ref-for-authenticator-extension\u2468"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u24ea"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2460"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2462"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2463"},{"id":"ref-for-authenticator-extension\u2460\u2464"},{"id":"ref-for-authenticator-extension\u2460\u2465"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2466"},{"id":"ref-for-authenticator-extension\u2460\u2467"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticator-extension"},
+"authenticator-extension": {"dfnID":"authenticator-extension","dfnText":"authenticator extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-extension\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator-extension\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-extension\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator-extension\u2464"},{"id":"ref-for-authenticator-extension\u2465"},{"id":"ref-for-authenticator-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2467"},{"id":"ref-for-authenticator-extension\u2468"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u24ea"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2460"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2462"},{"id":"ref-for-authenticator-extension\u2460\u2463"},{"id":"ref-for-authenticator-extension\u2460\u2464"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-authenticator-extension\u2460\u2465"},{"id":"ref-for-authenticator-extension\u2460\u2466"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticator-extension"},
 "authenticator-extension-capabilities": {"dfnID":"authenticator-extension-capabilities","dfnText":"Authenticator Extension Capabilities","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension-capabilities"},{"id":"ref-for-authenticator-extension-capabilities\u2460"},{"id":"ref-for-authenticator-extension-capabilities\u2461"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#authenticator-extension-capabilities"},
 "authenticator-extension-input": {"dfnID":"authenticator-extension-input","dfnText":"authenticator extension input","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension-input"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2460"},{"id":"ref-for-authenticator-extension-input\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2462"},{"id":"ref-for-authenticator-extension-input\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2464"},{"id":"ref-for-authenticator-extension-input\u2465"},{"id":"ref-for-authenticator-extension-input\u2466"},{"id":"ref-for-authenticator-extension-input\u2467"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2468"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2460\u24ea"},{"id":"ref-for-authenticator-extension-input\u2460\u2460"},{"id":"ref-for-authenticator-extension-input\u2460\u2461"},{"id":"ref-for-authenticator-extension-input\u2460\u2462"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2460\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension-input\u2460\u2464"},{"id":"ref-for-authenticator-extension-input\u2460\u2465"},{"id":"ref-for-authenticator-extension-input\u2460\u2466"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#authenticator-extension-input"},
-"authenticator-extension-output": {"dfnID":"authenticator-extension-output","dfnText":"authenticator extension output","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension-output"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2462"},{"id":"ref-for-authenticator-extension-output\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2464"},{"id":"ref-for-authenticator-extension-output\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2466"},{"id":"ref-for-authenticator-extension-output\u2467"},{"id":"ref-for-authenticator-extension-output\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u24ea"},{"id":"ref-for-authenticator-extension-output\u2460\u2460"},{"id":"ref-for-authenticator-extension-output\u2460\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2462"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2464"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2465"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2466"},{"id":"ref-for-authenticator-extension-output\u2460\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2468"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2461\u24ea"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2461\u2460"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticator-extension-output"},
+"authenticator-extension-output": {"dfnID":"authenticator-extension-output","dfnText":"authenticator extension output","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension-output"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2462"},{"id":"ref-for-authenticator-extension-output\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2464"},{"id":"ref-for-authenticator-extension-output\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2466"},{"id":"ref-for-authenticator-extension-output\u2467"},{"id":"ref-for-authenticator-extension-output\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u24ea"},{"id":"ref-for-authenticator-extension-output\u2460\u2460"},{"id":"ref-for-authenticator-extension-output\u2460\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2462"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension-output\u2460\u2464"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#authenticator-extension-output"},
 "authenticator-extension-processing": {"dfnID":"authenticator-extension-processing","dfnText":"Authenticator Extension Processing","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-extension-processing"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-extension-processing\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-extension-processing\u2461"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-processing\u2462"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticator-extension-processing\u2463"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticator-extension-processing\u2464"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#authenticator-extension-processing"},
 "authenticator-model": {"dfnID":"authenticator-model","dfnText":"Authenticator Model","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-model"},{"id":"ref-for-authenticator-model\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-model\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator-model\u2462"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authenticator-model\u2463"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"#authenticator-model"},
 "authenticator-operations": {"dfnID":"authenticator-operations","dfnText":"Authenticator Operations","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-operations"}],"title":"4. Terminology"}],"url":"#authenticator-operations"},
 "authenticator-session": {"dfnID":"authenticator-session","dfnText":"authenticator session","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-session"},{"id":"ref-for-authenticator-session\u2460"}],"title":"5.6. Abort Operations with AbortSignal"},{"refs":[{"id":"ref-for-authenticator-session\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-session\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-session\u2463"},{"id":"ref-for-authenticator-session\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"}],"url":"#authenticator-session"},
 "authenticator-type": {"dfnID":"authenticator-type","dfnText":"authenticator type","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-type\u2460"},{"id":"ref-for-authenticator-type\u2461"},{"id":"ref-for-authenticator-type\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-type"},
-"authenticatorassertionresponse": {"dfnID":"authenticatorassertionresponse","dfnText":"AuthenticatorAssertionResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorassertionresponse"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2462"},{"id":"ref-for-authenticatorassertionresponse\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2467"}],"title":"14.6.2. Username Enumeration"}],"url":"#authenticatorassertionresponse"},
-"authenticatorattestationresponse": {"dfnID":"authenticatorattestationresponse","dfnText":"AuthenticatorAttestationResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorattestationresponse"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2461"},{"id":"ref-for-authenticatorattestationresponse\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2463"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2464"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2465"},{"id":"ref-for-authenticatorattestationresponse\u2466"}],"title":"7.1. Registering a New Credential"}],"url":"#authenticatorattestationresponse"},
-"authenticatorcancel": {"dfnID":"authenticatorcancel","dfnText":"authenticatorCancel","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorcancel"},{"id":"ref-for-authenticatorcancel\u2460"},{"id":"ref-for-authenticatorcancel\u2461"},{"id":"ref-for-authenticatorcancel\u2462"},{"id":"ref-for-authenticatorcancel\u2463"},{"id":"ref-for-authenticatorcancel\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2465"},{"id":"ref-for-authenticatorcancel\u2466"},{"id":"ref-for-authenticatorcancel\u2467"},{"id":"ref-for-authenticatorcancel\u2468"},{"id":"ref-for-authenticatorcancel\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#authenticatorcancel"},
-"authenticatorgetassertion": {"dfnID":"authenticatorgetassertion","dfnText":"authenticatorGetAssertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorgetassertion"},{"id":"ref-for-authenticatorgetassertion\u2460"},{"id":"ref-for-authenticatorgetassertion\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2463"},{"id":"ref-for-authenticatorgetassertion\u2464"},{"id":"ref-for-authenticatorgetassertion\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2468"},{"id":"ref-for-authenticatorgetassertion\u2460\u24ea"},{"id":"ref-for-authenticatorgetassertion\u2460\u2460"},{"id":"ref-for-authenticatorgetassertion\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2462"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2463"},{"id":"ref-for-authenticatorgetassertion\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2467"},{"id":"ref-for-authenticatorgetassertion\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u24ea"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u2461"},{"id":"ref-for-authenticatorgetassertion\u2461\u2462"}],"title":"11.5. Add Credential"}],"url":"#authenticatorgetassertion"},
+"authenticatorassertionresponse": {"dfnID":"authenticatorassertionresponse","dfnText":"AuthenticatorAssertionResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorassertionresponse"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2462"},{"id":"ref-for-authenticatorassertionresponse\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticatorassertionresponse\u2467"}],"title":"14.6.2. Username Enumeration"}],"url":"#authenticatorassertionresponse"},
+"authenticatorattestationresponse": {"dfnID":"authenticatorattestationresponse","dfnText":"AuthenticatorAttestationResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorattestationresponse"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2461"},{"id":"ref-for-authenticatorattestationresponse\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2463"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2464"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authenticatorattestationresponse\u2465"},{"id":"ref-for-authenticatorattestationresponse\u2466"}],"title":"7.1. Registering a New Credential"}],"url":"#authenticatorattestationresponse"},
+"authenticatorcancel": {"dfnID":"authenticatorcancel","dfnText":"authenticatorCancel","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorcancel"},{"id":"ref-for-authenticatorcancel\u2460"},{"id":"ref-for-authenticatorcancel\u2461"},{"id":"ref-for-authenticatorcancel\u2462"},{"id":"ref-for-authenticatorcancel\u2463"},{"id":"ref-for-authenticatorcancel\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2465"},{"id":"ref-for-authenticatorcancel\u2466"},{"id":"ref-for-authenticatorcancel\u2467"},{"id":"ref-for-authenticatorcancel\u2468"},{"id":"ref-for-authenticatorcancel\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#authenticatorcancel"},
+"authenticatorgetassertion": {"dfnID":"authenticatorgetassertion","dfnText":"authenticatorGetAssertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorgetassertion"},{"id":"ref-for-authenticatorgetassertion\u2460"},{"id":"ref-for-authenticatorgetassertion\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2463"},{"id":"ref-for-authenticatorgetassertion\u2464"},{"id":"ref-for-authenticatorgetassertion\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2468"},{"id":"ref-for-authenticatorgetassertion\u2460\u24ea"},{"id":"ref-for-authenticatorgetassertion\u2460\u2460"},{"id":"ref-for-authenticatorgetassertion\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2462"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2463"},{"id":"ref-for-authenticatorgetassertion\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2467"},{"id":"ref-for-authenticatorgetassertion\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u24ea"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u2460"},{"id":"ref-for-authenticatorgetassertion\u2461\u2461"}],"title":"11.5. Add Credential"}],"url":"#authenticatorgetassertion"},
 "authenticatorid": {"dfnID":"authenticatorid","dfnText":"authenticatorId","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorid"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticatorid"},
-"authenticatormakecredential": {"dfnID":"authenticatormakecredential","dfnText":"authenticatorMakeCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatormakecredential"},{"id":"ref-for-authenticatormakecredential\u2460"},{"id":"ref-for-authenticatormakecredential\u2461"},{"id":"ref-for-authenticatormakecredential\u2462"},{"id":"ref-for-authenticatormakecredential\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2464"},{"id":"ref-for-authenticatormakecredential\u2465"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2466"},{"id":"ref-for-authenticatormakecredential\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2460"},{"id":"ref-for-authenticatormakecredential\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2462"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2463"},{"id":"ref-for-authenticatormakecredential\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2467"},{"id":"ref-for-authenticatormakecredential\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u2461"},{"id":"ref-for-authenticatormakecredential\u2461\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticatormakecredential"},
+"authenticatormakecredential": {"dfnID":"authenticatormakecredential","dfnText":"authenticatorMakeCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatormakecredential"},{"id":"ref-for-authenticatormakecredential\u2460"},{"id":"ref-for-authenticatormakecredential\u2461"},{"id":"ref-for-authenticatormakecredential\u2462"},{"id":"ref-for-authenticatormakecredential\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2464"},{"id":"ref-for-authenticatormakecredential\u2465"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2466"},{"id":"ref-for-authenticatormakecredential\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2460"},{"id":"ref-for-authenticatormakecredential\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2462"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2463"},{"id":"ref-for-authenticatormakecredential\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2467"},{"id":"ref-for-authenticatormakecredential\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u24ea"},{"id":"ref-for-authenticatormakecredential\u2461\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u2461"},{"id":"ref-for-authenticatormakecredential\u2461\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticatormakecredential"},
 "authenticatorresponse": {"dfnID":"authenticatorresponse","dfnText":"AuthenticatorResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorresponse"},{"id":"ref-for-authenticatorresponse\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorresponse\u2461"},{"id":"ref-for-authenticatorresponse\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2463"},{"id":"ref-for-authenticatorresponse\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2465"},{"id":"ref-for-authenticatorresponse\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"#authenticatorresponse"},
-"authorization-gesture": {"dfnID":"authorization-gesture","dfnText":"Authorization Gesture","external":false,"refSections":[{"refs":[{"id":"ref-for-authorization-gesture"}],"title":"1.2.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2460"}],"title":"1.2.2. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2461"},{"id":"ref-for-authorization-gesture\u2462"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2463"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-authorization-gesture\u2464"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2465"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2466"},{"id":"ref-for-authorization-gesture\u2467"},{"id":"ref-for-authorization-gesture\u2468"},{"id":"ref-for-authorization-gesture\u2460\u24ea"},{"id":"ref-for-authorization-gesture\u2460\u2460"},{"id":"ref-for-authorization-gesture\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2462"},{"id":"ref-for-authorization-gesture\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2465"},{"id":"ref-for-authorization-gesture\u2460\u2466"},{"id":"ref-for-authorization-gesture\u2460\u2467"},{"id":"ref-for-authorization-gesture\u2460\u2468"},{"id":"ref-for-authorization-gesture\u2461\u24ea"},{"id":"ref-for-authorization-gesture\u2461\u2460"},{"id":"ref-for-authorization-gesture\u2461\u2461"},{"id":"ref-for-authorization-gesture\u2461\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2463"},{"id":"ref-for-authorization-gesture\u2461\u2464"},{"id":"ref-for-authorization-gesture\u2461\u2465"},{"id":"ref-for-authorization-gesture\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2468"}],"title":"15. Accessibility Considerations"}],"url":"#authorization-gesture"},
+"authorization-gesture": {"dfnID":"authorization-gesture","dfnText":"Authorization Gesture","external":false,"refSections":[{"refs":[{"id":"ref-for-authorization-gesture"}],"title":"1.2.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2460"}],"title":"1.2.2. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2461"},{"id":"ref-for-authorization-gesture\u2462"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2463"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-authorization-gesture\u2464"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2465"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2466"},{"id":"ref-for-authorization-gesture\u2467"},{"id":"ref-for-authorization-gesture\u2468"},{"id":"ref-for-authorization-gesture\u2460\u24ea"},{"id":"ref-for-authorization-gesture\u2460\u2460"},{"id":"ref-for-authorization-gesture\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2462"},{"id":"ref-for-authorization-gesture\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2465"},{"id":"ref-for-authorization-gesture\u2460\u2466"},{"id":"ref-for-authorization-gesture\u2460\u2467"},{"id":"ref-for-authorization-gesture\u2460\u2468"},{"id":"ref-for-authorization-gesture\u2461\u24ea"},{"id":"ref-for-authorization-gesture\u2461\u2460"},{"id":"ref-for-authorization-gesture\u2461\u2461"},{"id":"ref-for-authorization-gesture\u2461\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2463"},{"id":"ref-for-authorization-gesture\u2461\u2464"},{"id":"ref-for-authorization-gesture\u2461\u2465"},{"id":"ref-for-authorization-gesture\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2468"}],"title":"15. Accessibility Considerations"}],"url":"#authorization-gesture"},
 "b05bf85d": {"dfnID":"b05bf85d","dfnText":"buffer source types","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-buffer-source-type"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-buffer-source-type\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
-"b0d7f3c3": {"dfnID":"b0d7f3c3","dfnText":"USVString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-USVString"},{"id":"ref-for-idl-USVString\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-USVString\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-USVString\u2462"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-USVString\u2463"},{"id":"ref-for-idl-USVString\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-USVString\u2465"},{"id":"ref-for-idl-USVString\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-USVString"},
-"b0f5bc03": {"dfnID":"b0f5bc03","dfnText":"create()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-create"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2465"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2466"},{"id":"ref-for-dom-credentialscontainer-create\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2463"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2464"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2465"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2466"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2463"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2464"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2465"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2466"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2468"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2463\u24ea"}],"title":"11.6. Get Credentials"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
+"b0f5bc03": {"dfnID":"b0f5bc03","dfnText":"create()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-create"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2464"},{"id":"ref-for-dom-credentialscontainer-create\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2466"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2463"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2465"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2466"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u24ea"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2464"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2466"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2467"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2461"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2462"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2464"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2465"}],"title":"11.6. Get Credentials"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
 "b0f631d2": {"dfnID":"b0f631d2","dfnText":"willful violation","external":true,"refSections":[{"refs":[{"id":"ref-for-willful-violation"}],"title":"4. Terminology"}],"url":"https://infra.spec.whatwg.org/#willful-violation"},
-"b0fcb8d7": {"dfnID":"b0fcb8d7","dfnText":"utf-8 decode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-decode"},{"id":"ref-for-utf-8-decode\u2460"},{"id":"ref-for-utf-8-decode\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-utf-8-decode\u2462"},{"id":"ref-for-utf-8-decode\u2463"},{"id":"ref-for-utf-8-decode\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
+"b0fcb8d7": {"dfnID":"b0fcb8d7","dfnText":"UTF-8 decode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-decode"},{"id":"ref-for-utf-8-decode\u2460"},{"id":"ref-for-utf-8-decode\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-utf-8-decode\u2462"},{"id":"ref-for-utf-8-decode\u2463"},{"id":"ref-for-utf-8-decode\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
+"b262501e": {"dfnID":"b262501e","dfnText":"reject","external":true,"refSections":[{"refs":[{"id":"ref-for-reject"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#reject"},
 "b2ac942d": {"dfnID":"b2ac942d","dfnText":"section 2.1","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2.1"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-section-2.1\u2465"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc9053#section-2.1"},
-"b3829b46": {"dfnID":"b3829b46","dfnText":"CredentialCreationOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialcreationoptions"},{"id":"ref-for-dictdef-credentialcreationoptions\u2460"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-credentialcreationoptions\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions"},
-"b410a6ef": {"dfnID":"b410a6ef","dfnText":"ascii serialization of an origin","external":true,"refSections":[{"refs":[{"id":"ref-for-ascii-serialisation-of-an-origin"},{"id":"ref-for-ascii-serialisation-of-an-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-ascii-serialisation-of-an-origin\u2461"},{"id":"ref-for-ascii-serialisation-of-an-origin\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin"},
+"b3829b46": {"dfnID":"b3829b46","dfnText":"CredentialCreationOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialcreationoptions"},{"id":"ref-for-dictdef-credentialcreationoptions\u2460"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-credentialcreationoptions\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-credentialcreationoptions\u2462"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions"},
+"b410a6ef": {"dfnID":"b410a6ef","dfnText":"ASCII serialization of an origin","external":true,"refSections":[{"refs":[{"id":"ref-for-ascii-serialisation-of-an-origin"},{"id":"ref-for-ascii-serialisation-of-an-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-ascii-serialisation-of-an-origin\u2461"},{"id":"ref-for-ascii-serialisation-of-an-origin\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin"},
 "b705e53a": {"dfnID":"b705e53a","dfnText":"man-in-the-middle attack","external":true,"refSections":[{"refs":[{"id":"ref-for-page-186"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-page-186\u2460"},{"id":"ref-for-page-186\u2461"},{"id":"ref-for-page-186\u2462"},{"id":"ref-for-page-186\u2463"},{"id":"ref-for-page-186\u2464"},{"id":"ref-for-page-186\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-page-186\u2466"}],"title":"13.4.8. Code injection attacks"}],"url":"https://tools.ietf.org/html/rfc4949#page-186"},
 "b75bb3bd": {"dfnID":"b75bb3bd","dfnText":"SecureContext","external":true,"refSections":[{"refs":[{"id":"ref-for-SecureContext"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-SecureContext\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-SecureContext\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-SecureContext\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#SecureContext"},
-"b85ee3be": {"dfnID":"b85ee3be","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-host"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-host\u2460"},{"id":"ref-for-concept-url-host\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-url-host\u2462"},{"id":"ref-for-concept-url-host\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-url-host"},
-"ba556545": {"dfnID":"ba556545","dfnText":"NotAllowedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notallowederror"},{"id":"ref-for-notallowederror\u2460"},{"id":"ref-for-notallowederror\u2461"},{"id":"ref-for-notallowederror\u2462"},{"id":"ref-for-notallowederror\u2463"},{"id":"ref-for-notallowederror\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2465"},{"id":"ref-for-notallowederror\u2466"},{"id":"ref-for-notallowederror\u2467"},{"id":"ref-for-notallowederror\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u24ea"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2461"},{"id":"ref-for-notallowederror\u2460\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2463"},{"id":"ref-for-notallowederror\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#notallowederror"},
+"b85ee3be": {"dfnID":"b85ee3be","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-host"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-host\u2460"},{"id":"ref-for-concept-url-host\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-url-host\u2462"},{"id":"ref-for-concept-url-host\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#concept-url-host"},
+"ba556545": {"dfnID":"ba556545","dfnText":"NotAllowedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notallowederror"},{"id":"ref-for-notallowederror\u2460"},{"id":"ref-for-notallowederror\u2461"},{"id":"ref-for-notallowederror\u2462"},{"id":"ref-for-notallowederror\u2463"},{"id":"ref-for-notallowederror\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-notallowederror\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2466"},{"id":"ref-for-notallowederror\u2467"},{"id":"ref-for-notallowederror\u2468"},{"id":"ref-for-notallowederror\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2463"},{"id":"ref-for-notallowederror\u2460\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2465"},{"id":"ref-for-notallowederror\u2460\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#notallowederror"},
 "ba9c2b34": {"dfnID":"ba9c2b34","dfnText":"single-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-sf"}],"title":"6.2. Authenticator Taxonomy"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf"},
-"backed-up": {"dfnID":"backed-up","dfnText":"Backed Up","external":false,"refSections":[{"refs":[{"id":"ref-for-backed-up"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backed-up\u2460"},{"id":"ref-for-backed-up\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backed-up\u2462"},{"id":"ref-for-backed-up\u2463"}],"title":"6.1.3. Credential Backup State"}],"url":"#backed-up"},
+"backed-up": {"dfnID":"backed-up","dfnText":"Backed Up","external":false,"refSections":[{"refs":[{"id":"ref-for-backed-up"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backed-up\u2460"},{"id":"ref-for-backed-up\u2461"},{"id":"ref-for-backed-up\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backed-up\u2463"},{"id":"ref-for-backed-up\u2464"}],"title":"6.1.3. Credential Backup State"}],"url":"#backed-up"},
 "backup-eligibility": {"dfnID":"backup-eligibility","dfnText":"Backup Eligibility","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligibility"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backup-eligibility\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-eligibility\u2461"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-backup-eligibility\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-backup-eligibility\u2464"},{"id":"ref-for-backup-eligibility\u2465"},{"id":"ref-for-backup-eligibility\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2467"},{"id":"ref-for-backup-eligibility\u2468"}],"title":"11.10. Set Credential Properties"}],"url":"#backup-eligibility"},
-"backup-eligible": {"dfnID":"backup-eligible","dfnText":"Backup Eligible","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligible"},{"id":"ref-for-backup-eligible\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-eligible\u2461"},{"id":"ref-for-backup-eligible\u2462"}],"title":"10.2.2.1. Relying Party Usage"}],"url":"#backup-eligible"},
+"backup-eligible": {"dfnID":"backup-eligible","dfnText":"Backup Eligible","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligible"},{"id":"ref-for-backup-eligible\u2460"}],"title":"6.1. Authenticator Data"}],"url":"#backup-eligible"},
 "backup-state": {"dfnID":"backup-state","dfnText":"Backup State","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-state"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backup-state\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-state\u2461"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-backup-state\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-backup-state\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-backup-state\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-backup-state\u2465"},{"id":"ref-for-backup-state\u2466"},{"id":"ref-for-backup-state\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-backup-state\u2468"},{"id":"ref-for-backup-state\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"#backup-state"},
-"base64url-encoding": {"dfnID":"base64url-encoding","dfnText":"Base64url Encoding","external":false,"refSections":[{"refs":[{"id":"ref-for-base64url-encoding"},{"id":"ref-for-base64url-encoding\u2460"},{"id":"ref-for-base64url-encoding\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-base64url-encoding\u2462"},{"id":"ref-for-base64url-encoding\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2464"},{"id":"ref-for-base64url-encoding\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2466"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-base64url-encoding\u2467"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2460"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2461"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2464"},{"id":"ref-for-base64url-encoding\u2460\u2465"},{"id":"ref-for-base64url-encoding\u2460\u2466"},{"id":"ref-for-base64url-encoding\u2460\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2468"},{"id":"ref-for-base64url-encoding\u2461\u24ea"},{"id":"ref-for-base64url-encoding\u2461\u2460"},{"id":"ref-for-base64url-encoding\u2461\u2461"},{"id":"ref-for-base64url-encoding\u2461\u2462"},{"id":"ref-for-base64url-encoding\u2461\u2463"},{"id":"ref-for-base64url-encoding\u2461\u2464"},{"id":"ref-for-base64url-encoding\u2461\u2465"}],"title":"11.5. Add Credential"}],"url":"#base64url-encoding"},
+"base64url-encoding": {"dfnID":"base64url-encoding","dfnText":"Base64url Encoding","external":false,"refSections":[{"refs":[{"id":"ref-for-base64url-encoding"},{"id":"ref-for-base64url-encoding\u2460"},{"id":"ref-for-base64url-encoding\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-base64url-encoding\u2462"},{"id":"ref-for-base64url-encoding\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2464"},{"id":"ref-for-base64url-encoding\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2466"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-base64url-encoding\u2467"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-base64url-encoding\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u24ea"},{"id":"ref-for-base64url-encoding\u2460\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2461"},{"id":"ref-for-base64url-encoding\u2460\u2462"},{"id":"ref-for-base64url-encoding\u2460\u2463"},{"id":"ref-for-base64url-encoding\u2460\u2464"},{"id":"ref-for-base64url-encoding\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2466"},{"id":"ref-for-base64url-encoding\u2460\u2467"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-base64url-encoding\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u24ea"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u2460"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u2462"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u2463"},{"id":"ref-for-base64url-encoding\u2461\u2464"},{"id":"ref-for-base64url-encoding\u2461\u2465"},{"id":"ref-for-base64url-encoding\u2461\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-base64url-encoding\u2461\u2467"},{"id":"ref-for-base64url-encoding\u2461\u2468"},{"id":"ref-for-base64url-encoding\u2462\u24ea"},{"id":"ref-for-base64url-encoding\u2462\u2460"},{"id":"ref-for-base64url-encoding\u2462\u2461"},{"id":"ref-for-base64url-encoding\u2462\u2462"},{"id":"ref-for-base64url-encoding\u2462\u2463"},{"id":"ref-for-base64url-encoding\u2462\u2464"}],"title":"11.5. Add Credential"}],"url":"#base64url-encoding"},
 "basic": {"dfnID":"basic","dfnText":"Basic","external":false,"refSections":[{"refs":[{"id":"ref-for-basic"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-basic\u2460"},{"id":"ref-for-basic\u2461"},{"id":"ref-for-basic\u2462"},{"id":"ref-for-basic\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-basic\u2464"},{"id":"ref-for-basic\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-basic\u2466"},{"id":"ref-for-basic\u2467"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-basic\u2468"},{"id":"ref-for-basic\u2460\u24ea"},{"id":"ref-for-basic\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#basic"},
 "basic-attestation": {"dfnID":"basic-attestation","dfnText":"Basic Attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-basic-attestation"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-basic-attestation\u2460"}],"title":"14.4.1. Attestation Privacy"}],"url":"#basic-attestation"},
 "batch-attestation": {"dfnID":"batch-attestation","dfnText":"batch attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-batch-attestation"}],"title":"14.4.1. Attestation Privacy"}],"url":"#batch-attestation"},
 "bb3da43a": {"dfnID":"bb3da43a","dfnText":"port","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-port"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-port\u2460"},{"id":"ref-for-concept-url-port\u2461"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org#concept-url-port"},
-"bdbd19d1": {"dfnID":"bdbd19d1","dfnText":"Promise","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-promise"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-promise\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-promise\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-promise\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-promise\u2463"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-promise\u2464"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-promise\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://webidl.spec.whatwg.org/#idl-promise"},
+"bc9d7803": {"dfnID":"bc9d7803","dfnText":"registrable domain","external":true,"refSections":[{"refs":[{"id":"ref-for-host-registrable-domain"},{"id":"ref-for-host-registrable-domain\u2460"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#host-registrable-domain"},
+"bd6b32a4": {"dfnID":"bd6b32a4","dfnText":"public suffix","external":true,"refSections":[{"refs":[{"id":"ref-for-host-public-suffix"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#host-public-suffix"},
+"bdbd19d1": {"dfnID":"bdbd19d1","dfnText":"Promise","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-promise"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-promise\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-promise\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-promise\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-promise\u2463"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-promise\u2464"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-promise\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-promise\u2466"},{"id":"ref-for-idl-promise\u2467"},{"id":"ref-for-idl-promise\u2468"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"}],"url":"https://webidl.spec.whatwg.org/#idl-promise"},
 "be2d2b4c": {"dfnID":"be2d2b4c","dfnText":"SyntaxError","external":true,"refSections":[{"refs":[{"id":"ref-for-syntaxerror"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#syntaxerror"},
 "biometric-authenticator": {"dfnID":"biometric-authenticator","dfnText":"Biometric Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-biometric-authenticator"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-biometric-authenticator\u2460"},{"id":"ref-for-biometric-authenticator\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#biometric-authenticator"},
 "biometric-recognition": {"dfnID":"biometric-recognition","dfnText":"Biometric Recognition","external":false,"refSections":[{"refs":[{"id":"ref-for-biometric-recognition"},{"id":"ref-for-biometric-recognition\u2460"},{"id":"ref-for-biometric-recognition\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-biometric-recognition\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-biometric-recognition\u2463"},{"id":"ref-for-biometric-recognition\u2464"},{"id":"ref-for-biometric-recognition\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#biometric-recognition"},
-"bound-credential": {"dfnID":"bound-credential","dfnText":"Bound credential","external":false,"refSections":[{"refs":[{"id":"ref-for-bound-credential\u2460"},{"id":"ref-for-bound-credential\u2461"},{"id":"ref-for-bound-credential\u2462"},{"id":"ref-for-bound-credential\u2463"},{"id":"ref-for-bound-credential\u2464"},{"id":"ref-for-bound-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-bound-credential\u2466"},{"id":"ref-for-bound-credential\u2467"},{"id":"ref-for-bound-credential\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-bound-credential\u2460\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2460"},{"id":"ref-for-bound-credential\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2462"},{"id":"ref-for-bound-credential\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2464"},{"id":"ref-for-bound-credential\u2460\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#bound-credential"},
-"c15f1628": {"dfnID":"c15f1628","dfnText":"internal slot","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461\u24ea"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
+"bound-credential": {"dfnID":"bound-credential","dfnText":"Bound credential","external":false,"refSections":[{"refs":[{"id":"ref-for-bound-credential\u2460"},{"id":"ref-for-bound-credential\u2461"},{"id":"ref-for-bound-credential\u2462"},{"id":"ref-for-bound-credential\u2463"},{"id":"ref-for-bound-credential\u2464"},{"id":"ref-for-bound-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-bound-credential\u2466"},{"id":"ref-for-bound-credential\u2467"},{"id":"ref-for-bound-credential\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-bound-credential\u2460\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2460"},{"id":"ref-for-bound-credential\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2462"},{"id":"ref-for-bound-credential\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2465"},{"id":"ref-for-bound-credential\u2460\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#bound-credential"},
+"c15f1628": {"dfnID":"c15f1628","dfnText":"internal slot","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
 "c1f02de3": {"dfnID":"c1f02de3","dfnText":"salt","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
-"c3e881ef": {"dfnID":"c3e881ef","dfnText":"SecurityError","external":true,"refSections":[{"refs":[{"id":"ref-for-securityerror"},{"id":"ref-for-securityerror\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2461"},{"id":"ref-for-securityerror\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2463"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-securityerror\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#securityerror"},
-"c63519ed": {"dfnID":"c63519ed","dfnText":"top-level origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-environment-top-level-origin"},{"id":"ref-for-concept-environment-top-level-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
-"c88f3887": {"dfnID":"c88f3887","dfnText":"item (for struct)","external":true,"refSections":[{"refs":[{"id":"ref-for-struct-item"},{"id":"ref-for-struct-item\u2460"},{"id":"ref-for-struct-item\u2461"},{"id":"ref-for-struct-item\u2462"},{"id":"ref-for-struct-item\u2463"},{"id":"ref-for-struct-item\u2464"},{"id":"ref-for-struct-item\u2465"},{"id":"ref-for-struct-item\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct-item\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct-item\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct-item\u2460\u24ea"},{"id":"ref-for-struct-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct-item\u2460\u2461"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-struct-item\u2460\u2462"},{"id":"ref-for-struct-item\u2460\u2463"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"https://infra.spec.whatwg.org/#struct-item"},
-"caa78262": {"dfnID":"caa78262","dfnText":"section 3.1 user verification methods","external":true,"refSections":[{"refs":[{"id":"ref-for-user-verification-methods"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods"},
+"c3e881ef": {"dfnID":"c3e881ef","dfnText":"SecurityError","external":true,"refSections":[{"refs":[{"id":"ref-for-securityerror"},{"id":"ref-for-securityerror\u2460"},{"id":"ref-for-securityerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-securityerror\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2463"},{"id":"ref-for-securityerror\u2464"},{"id":"ref-for-securityerror\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-securityerror\u2466"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2467"},{"id":"ref-for-securityerror\u2468"},{"id":"ref-for-securityerror\u2460\u24ea"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-securityerror\u2460\u2460"},{"id":"ref-for-securityerror\u2460\u2461"},{"id":"ref-for-securityerror\u2460\u2462"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-securityerror\u2460\u2463"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-securityerror\u2460\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#securityerror"},
+"c63519ed": {"dfnID":"c63519ed","dfnText":"top-level origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-environment-top-level-origin"},{"id":"ref-for-concept-environment-top-level-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
+"c88f3887": {"dfnID":"c88f3887","dfnText":"item (for struct)","external":true,"refSections":[{"refs":[{"id":"ref-for-struct-item"},{"id":"ref-for-struct-item\u2460"},{"id":"ref-for-struct-item\u2461"},{"id":"ref-for-struct-item\u2462"},{"id":"ref-for-struct-item\u2463"},{"id":"ref-for-struct-item\u2464"},{"id":"ref-for-struct-item\u2465"},{"id":"ref-for-struct-item\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct-item\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2460\u24ea"},{"id":"ref-for-struct-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct-item\u2460\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"https://infra.spec.whatwg.org/#struct-item"},
+"ca3ca4ae": {"dfnID":"ca3ca4ae","dfnText":"URL parser","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-parser"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://url.spec.whatwg.org/#concept-url-parser"},
 "cb9acc83": {"dfnID":"cb9acc83","dfnText":"set a property","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-set-a-property"},{"id":"ref-for-dfn-set-a-property\u2460"},{"id":"ref-for-dfn-set-a-property\u2461"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-set-a-property"},
-"cbdc89b4": {"dfnID":"cbdc89b4","dfnText":"while","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-while"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-iteration-while\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://infra.spec.whatwg.org/#iteration-while"},
+"cbdc89b4": {"dfnID":"cbdc89b4","dfnText":"while","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-while"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-iteration-while\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://infra.spec.whatwg.org/#iteration-while"},
 "cbdd0aff": {"dfnID":"cbdd0aff","dfnText":"id","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-id"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credential-id\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credential-id\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-id"},
-"cbor": {"dfnID":"cbor","dfnText":"CBOR","external":false,"refSections":[{"refs":[{"id":"ref-for-cbor"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-cbor\u2460"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-cbor\u2461"},{"id":"ref-for-cbor\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-cbor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-cbor\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-cbor\u2465"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-cbor\u2466"},{"id":"ref-for-cbor\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-cbor\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u2460"},{"id":"ref-for-cbor\u2460\u2461"},{"id":"ref-for-cbor\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2463"},{"id":"ref-for-cbor\u2460\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-cbor\u2460\u2466"},{"id":"ref-for-cbor\u2460\u2467"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-cbor\u2460\u2468"},{"id":"ref-for-cbor\u2461\u24ea"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-cbor\u2461\u2460"}],"title":"10.2.2.2. Extension Definition"}],"url":"#cbor"},
+"cbor": {"dfnID":"cbor","dfnText":"CBOR","external":false,"refSections":[{"refs":[{"id":"ref-for-cbor"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-cbor\u2460"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-cbor\u2461"},{"id":"ref-for-cbor\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-cbor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-cbor\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-cbor\u2465"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-cbor\u2466"},{"id":"ref-for-cbor\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-cbor\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u2460"},{"id":"ref-for-cbor\u2460\u2461"},{"id":"ref-for-cbor\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2463"},{"id":"ref-for-cbor\u2460\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-cbor\u2460\u2466"},{"id":"ref-for-cbor\u2460\u2467"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-cbor\u2460\u2468"},{"id":"ref-for-cbor\u2461\u24ea"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#cbor"},
 "cc890cc1": {"dfnID":"cc890cc1","dfnText":"policy-controlled feature","external":true,"refSections":[{"refs":[{"id":"ref-for-policy-controlled-feature"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature"},
 "cca3cdb2": {"dfnID":"cca3cdb2","dfnText":"AbortSignal","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortsignal"},
-"ccdtostring": {"dfnID":"ccdtostring","dfnText":"CCDToString","external":false,"refSections":[{"refs":[{"id":"ref-for-ccdtostring"},{"id":"ref-for-ccdtostring\u2460"},{"id":"ref-for-ccdtostring\u2461"},{"id":"ref-for-ccdtostring\u2462"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-ccdtostring\u2463"},{"id":"ref-for-ccdtostring\u2464"},{"id":"ref-for-ccdtostring\u2465"}],"title":"5.8.1.2. Limited Verification Algorithm"}],"url":"#ccdtostring"},
+"ccdtostring": {"dfnID":"ccdtostring","dfnText":"CCDToString","external":false,"refSections":[{"refs":[{"id":"ref-for-ccdtostring"},{"id":"ref-for-ccdtostring\u2460"},{"id":"ref-for-ccdtostring\u2461"},{"id":"ref-for-ccdtostring\u2462"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-ccdtostring\u2463"},{"id":"ref-for-ccdtostring\u2464"},{"id":"ref-for-ccdtostring\u2465"},{"id":"ref-for-ccdtostring\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"}],"url":"#ccdtostring"},
 "cce1676e": {"dfnID":"cce1676e","dfnText":"extension command","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-extension-commands"}],"title":"11. User Agent Automation"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2462"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2463"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2464"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2465"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2466"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2467"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2468"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-extension-commands"},
 "cddl": {"dfnID":"cddl","dfnText":"CDDL","external":false,"refSections":[{"refs":[{"id":"ref-for-cddl"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-cddl\u2460"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-cddl\u2461"}],"title":"9.3. Extending Request Parameters"}],"url":"#cddl"},
 "cece9985": {"dfnID":"cece9985","dfnText":"kty","external":true,"refSections":[{"refs":[{"id":"ref-for-name-cose-key-common-parameters"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
 "ceremony": {"dfnID":"ceremony","dfnText":"Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-ceremony"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-ceremony\u2460"},{"id":"ref-for-ceremony\u2461"},{"id":"ref-for-ceremony\u2462"},{"id":"ref-for-ceremony\u2463"},{"id":"ref-for-ceremony\u2464"},{"id":"ref-for-ceremony\u2465"},{"id":"ref-for-ceremony\u2466"},{"id":"ref-for-ceremony\u2467"},{"id":"ref-for-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ceremony\u2460\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-ceremony\u2460\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2465"},{"id":"ref-for-ceremony\u2460\u2466"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-ceremony\u2460\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#ceremony"},
-"cfc67fdc": {"dfnID":"cfc67fdc","dfnText":"empty host","external":true,"refSections":[{"refs":[{"id":"ref-for-empty-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-empty-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#empty-host"},
-"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2461"},{"id":"ref-for-client\u2461\u2462"},{"id":"ref-for-client\u2461\u2463"},{"id":"ref-for-client\u2461\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2461\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2461\u2467"},{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u24ea"},{"id":"ref-for-client\u2462\u2460"},{"id":"ref-for-client\u2462\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2462"},{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2462\u2465"},{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"},{"id":"ref-for-client\u2463\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2463\u2460"},{"id":"ref-for-client\u2463\u2461"},{"id":"ref-for-client\u2463\u2462"},{"id":"ref-for-client\u2463\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2463\u2468"},{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"},{"id":"ref-for-client\u2464\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2464\u2465"},{"id":"ref-for-client\u2464\u2466"},{"id":"ref-for-client\u2464\u2467"},{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2465\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2465\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2465\u2463"},{"id":"ref-for-client\u2465\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2465\u2465"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2465\u2466"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2466\u24ea"},{"id":"ref-for-client\u2466\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2466\u2462"},{"id":"ref-for-client\u2466\u2463"},{"id":"ref-for-client\u2466\u2464"},{"id":"ref-for-client\u2466\u2465"},{"id":"ref-for-client\u2466\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2466\u2467"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2466\u2468"},{"id":"ref-for-client\u2467\u24ea"},{"id":"ref-for-client\u2467\u2460"},{"id":"ref-for-client\u2467\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2467\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2467\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2467\u2464"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2467\u2465"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2467\u2466"},{"id":"ref-for-client\u2467\u2467"},{"id":"ref-for-client\u2467\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2468\u24ea"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2468\u2460"},{"id":"ref-for-client\u2468\u2461"},{"id":"ref-for-client\u2468\u2462"},{"id":"ref-for-client\u2468\u2463"},{"id":"ref-for-client\u2468\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2468\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2468\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"},{"id":"ref-for-client\u2460\u24ea\u24ea"},{"id":"ref-for-client\u2460\u24ea\u2460"},{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"},{"id":"ref-for-client\u2460\u24ea\u2463"},{"id":"ref-for-client\u2460\u24ea\u2464"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2465"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2466"},{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2464"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2465"},{"id":"ref-for-client\u2460\u2460\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2467"}],"title":"14.5. Privacy considerations for clients"}],"url":"#client"},
+"cfc67fdc": {"dfnID":"cfc67fdc","dfnText":"empty host","external":true,"refSections":[{"refs":[{"id":"ref-for-empty-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-empty-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#empty-host"},
+"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-client\u2463\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client\u2463\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client\u2463\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"},{"id":"ref-for-client\u2463\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2464"},{"id":"ref-for-client\u2464\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2466"},{"id":"ref-for-client\u2464\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"},{"id":"ref-for-client\u2465\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"},{"id":"ref-for-client\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"},{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"},{"id":"ref-for-client\u2466\u24ea"},{"id":"ref-for-client\u2466\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2466\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2466\u2463"},{"id":"ref-for-client\u2466\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2466"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2467"},{"id":"ref-for-client\u2466\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2467\u24ea"},{"id":"ref-for-client\u2467\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2467\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"},{"id":"ref-for-client\u2467\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2467"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2468"},{"id":"ref-for-client\u2468\u24ea"},{"id":"ref-for-client\u2468\u2460"},{"id":"ref-for-client\u2468\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2468\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2468\u2464"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u2465"},{"id":"ref-for-client\u2468\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"},{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"},{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2465"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2466"},{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"},{"id":"ref-for-client\u2460\u2461\u24ea"},{"id":"ref-for-client\u2460\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2461"},{"id":"ref-for-client\u2460\u2461\u2462"},{"id":"ref-for-client\u2460\u2461\u2463"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2464"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2465"},{"id":"ref-for-client\u2460\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2467"}],"title":"14.5. Privacy considerations for clients"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2468"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-client\u2460\u2462\u24ea"},{"id":"ref-for-client\u2460\u2462\u2460"},{"id":"ref-for-client\u2460\u2462\u2461"},{"id":"ref-for-client\u2460\u2462\u2462"}],"title":"16. Test Vectors"}],"url":"#client"},
 "client-data": {"dfnID":"client-data","dfnText":"client data","external":false,"refSections":[{"refs":[{"id":"ref-for-client-data"},{"id":"ref-for-client-data\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-client-data\u2461"},{"id":"ref-for-client-data\u2462"},{"id":"ref-for-client-data\u2463"},{"id":"ref-for-client-data\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-data\u2465"},{"id":"ref-for-client-data\u2466"},{"id":"ref-for-client-data\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-data\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-data\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-data\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2461"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-data\u2460\u2463"},{"id":"ref-for-client-data\u2460\u2464"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#client-data"},
-"client-device": {"dfnID":"client-device","dfnText":"Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-client-device"},{"id":"ref-for-client-device\u2460"},{"id":"ref-for-client-device\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-client-device\u2462"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-device\u2463"},{"id":"ref-for-client-device\u2464"},{"id":"ref-for-client-device\u2465"},{"id":"ref-for-client-device\u2466"},{"id":"ref-for-client-device\u2467"},{"id":"ref-for-client-device\u2468"},{"id":"ref-for-client-device\u2460\u24ea"},{"id":"ref-for-client-device\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-device\u2460\u2461"},{"id":"ref-for-client-device\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2463"},{"id":"ref-for-client-device\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2465"},{"id":"ref-for-client-device\u2460\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client-device\u2460\u2467"},{"id":"ref-for-client-device\u2460\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client-device\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-client-device\u2461\u2460"},{"id":"ref-for-client-device\u2461\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-device\u2461\u2462"},{"id":"ref-for-client-device\u2461\u2463"},{"id":"ref-for-client-device\u2461\u2464"},{"id":"ref-for-client-device\u2461\u2465"},{"id":"ref-for-client-device\u2461\u2466"},{"id":"ref-for-client-device\u2461\u2467"},{"id":"ref-for-client-device\u2461\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-device\u2462\u24ea"},{"id":"ref-for-client-device\u2462\u2460"},{"id":"ref-for-client-device\u2462\u2461"},{"id":"ref-for-client-device\u2462\u2462"},{"id":"ref-for-client-device\u2462\u2463"},{"id":"ref-for-client-device\u2462\u2464"},{"id":"ref-for-client-device\u2462\u2465"},{"id":"ref-for-client-device\u2462\u2466"},{"id":"ref-for-client-device\u2462\u2467"},{"id":"ref-for-client-device\u2462\u2468"},{"id":"ref-for-client-device\u2463\u24ea"},{"id":"ref-for-client-device\u2463\u2460"},{"id":"ref-for-client-device\u2463\u2461"},{"id":"ref-for-client-device\u2463\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2464"},{"id":"ref-for-client-device\u2463\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-client-device\u2463\u2466"},{"id":"ref-for-client-device\u2463\u2467"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#client-device"},
-"client-extension": {"dfnID":"client-extension","dfnText":"client extension","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension\u2466"}],"title":"10.1. Client Extensions"},{"refs":[{"id":"ref-for-client-extension\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-extension\u2468"},{"id":"ref-for-client-extension\u2460\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-client-extension\u2460\u2462"},{"id":"ref-for-client-extension\u2460\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#client-extension"},
-"client-extension-input": {"dfnID":"client-extension-input","dfnText":"client extension input","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-input"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client-extension-input\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client-extension-input\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client-extension-input\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client-extension-input\u2463"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-client-extension-input\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension-input\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension-input\u2466"},{"id":"ref-for-client-extension-input\u2467"},{"id":"ref-for-client-extension-input\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-input\u2460\u24ea"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension-input\u2460\u2460"},{"id":"ref-for-client-extension-input\u2460\u2461"},{"id":"ref-for-client-extension-input\u2460\u2462"},{"id":"ref-for-client-extension-input\u2460\u2463"},{"id":"ref-for-client-extension-input\u2460\u2464"},{"id":"ref-for-client-extension-input\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-client-extension-input\u2460\u2466"},{"id":"ref-for-client-extension-input\u2460\u2467"},{"id":"ref-for-client-extension-input\u2460\u2468"},{"id":"ref-for-client-extension-input\u2461\u24ea"}],"title":"9.4. Client Extension Processing"}],"url":"#client-extension-input"},
-"client-extension-output": {"dfnID":"client-extension-output","dfnText":"client extension output","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-output"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client-extension-output\u2460"},{"id":"ref-for-client-extension-output\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension-output\u2462"},{"id":"ref-for-client-extension-output\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension-output\u2464"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-client-extension-output\u2465"},{"id":"ref-for-client-extension-output\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension-output\u2467"},{"id":"ref-for-client-extension-output\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u24ea"},{"id":"ref-for-client-extension-output\u2460\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2461"},{"id":"ref-for-client-extension-output\u2460\u2462"},{"id":"ref-for-client-extension-output\u2460\u2463"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2464"},{"id":"ref-for-client-extension-output\u2460\u2465"},{"id":"ref-for-client-extension-output\u2460\u2466"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#client-extension-output"},
-"client-extension-processing": {"dfnID":"client-extension-processing","dfnText":"Client Extension Processing","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-processing"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client-extension-processing\u2460"},{"id":"ref-for-client-extension-processing\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension-processing\u2462"},{"id":"ref-for-client-extension-processing\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension-processing\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client-extension-processing\u2465"},{"id":"ref-for-client-extension-processing\u2466"},{"id":"ref-for-client-extension-processing\u2467"},{"id":"ref-for-client-extension-processing\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-processing\u2460\u24ea"}],"title":"9.2. Defining Extensions"}],"url":"#client-extension-processing"},
-"client-platform": {"dfnID":"client-platform","dfnText":"Client Platform","external":false,"refSections":[{"refs":[{"id":"ref-for-client-platform"},{"id":"ref-for-client-platform\u2460"},{"id":"ref-for-client-platform\u2461"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-platform\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client-platform\u2463"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client-platform\u2464"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-client-platform\u2465"},{"id":"ref-for-client-platform\u2466"},{"id":"ref-for-client-platform\u2467"},{"id":"ref-for-client-platform\u2468"},{"id":"ref-for-client-platform\u2460\u24ea"},{"id":"ref-for-client-platform\u2460\u2460"},{"id":"ref-for-client-platform\u2460\u2461"},{"id":"ref-for-client-platform\u2460\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-platform\u2460\u2463"},{"id":"ref-for-client-platform\u2460\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-client-platform\u2460\u2465"},{"id":"ref-for-client-platform\u2460\u2466"},{"id":"ref-for-client-platform\u2460\u2467"},{"id":"ref-for-client-platform\u2460\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-platform\u2461\u24ea"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-client-platform\u2461\u2460"},{"id":"ref-for-client-platform\u2461\u2461"},{"id":"ref-for-client-platform\u2461\u2462"},{"id":"ref-for-client-platform\u2461\u2463"},{"id":"ref-for-client-platform\u2461\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-platform\u2461\u2465"},{"id":"ref-for-client-platform\u2461\u2466"},{"id":"ref-for-client-platform\u2461\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client-platform\u2461\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client-platform\u2462\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client-platform\u2462\u2460"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2464"},{"id":"ref-for-client-platform\u2462\u2465"},{"id":"ref-for-client-platform\u2462\u2466"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2467"},{"id":"ref-for-client-platform\u2462\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client-platform\u2463\u24ea"},{"id":"ref-for-client-platform\u2463\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2461"},{"id":"ref-for-client-platform\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2463"},{"id":"ref-for-client-platform\u2463\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-platform\u2463\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-platform\u2463\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-platform\u2463\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-platform\u2463\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-platform\u2464\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-client-platform\u2464\u2460"},{"id":"ref-for-client-platform\u2464\u2461"},{"id":"ref-for-client-platform\u2464\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-platform\u2464\u2463"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-client-platform\u2464\u2464"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-client-platform\u2464\u2465"},{"id":"ref-for-client-platform\u2464\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#client-platform"},
+"client-device": {"dfnID":"client-device","dfnText":"Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-client-device"},{"id":"ref-for-client-device\u2460"},{"id":"ref-for-client-device\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-client-device\u2462"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-device\u2463"},{"id":"ref-for-client-device\u2464"},{"id":"ref-for-client-device\u2465"},{"id":"ref-for-client-device\u2466"},{"id":"ref-for-client-device\u2467"},{"id":"ref-for-client-device\u2468"},{"id":"ref-for-client-device\u2460\u24ea"},{"id":"ref-for-client-device\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-device\u2460\u2461"},{"id":"ref-for-client-device\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2463"},{"id":"ref-for-client-device\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2465"},{"id":"ref-for-client-device\u2460\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client-device\u2460\u2467"},{"id":"ref-for-client-device\u2460\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client-device\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-client-device\u2461\u2460"},{"id":"ref-for-client-device\u2461\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-device\u2461\u2462"},{"id":"ref-for-client-device\u2461\u2463"},{"id":"ref-for-client-device\u2461\u2464"},{"id":"ref-for-client-device\u2461\u2465"},{"id":"ref-for-client-device\u2461\u2466"},{"id":"ref-for-client-device\u2461\u2467"},{"id":"ref-for-client-device\u2461\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-device\u2462\u24ea"},{"id":"ref-for-client-device\u2462\u2460"},{"id":"ref-for-client-device\u2462\u2461"},{"id":"ref-for-client-device\u2462\u2462"},{"id":"ref-for-client-device\u2462\u2463"},{"id":"ref-for-client-device\u2462\u2464"},{"id":"ref-for-client-device\u2462\u2465"},{"id":"ref-for-client-device\u2462\u2466"},{"id":"ref-for-client-device\u2462\u2467"},{"id":"ref-for-client-device\u2462\u2468"},{"id":"ref-for-client-device\u2463\u24ea"},{"id":"ref-for-client-device\u2463\u2460"},{"id":"ref-for-client-device\u2463\u2461"},{"id":"ref-for-client-device\u2463\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2464"},{"id":"ref-for-client-device\u2463\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-client-device\u2463\u2466"},{"id":"ref-for-client-device\u2463\u2467"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#client-device"},
+"client-extension": {"dfnID":"client-extension","dfnText":"client extension","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension\u2466"}],"title":"10.1. Client Extensions"},{"refs":[{"id":"ref-for-client-extension\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-extension\u2468"},{"id":"ref-for-client-extension\u2460\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-client-extension\u2460\u2462"},{"id":"ref-for-client-extension\u2460\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#client-extension"},
+"client-extension-input": {"dfnID":"client-extension-input","dfnText":"client extension input","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-input"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client-extension-input\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client-extension-input\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client-extension-input\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client-extension-input\u2463"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-client-extension-input\u2464"},{"id":"ref-for-client-extension-input\u2465"},{"id":"ref-for-client-extension-input\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-input\u2467"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension-input\u2468"},{"id":"ref-for-client-extension-input\u2460\u24ea"},{"id":"ref-for-client-extension-input\u2460\u2460"},{"id":"ref-for-client-extension-input\u2460\u2461"},{"id":"ref-for-client-extension-input\u2460\u2462"},{"id":"ref-for-client-extension-input\u2460\u2463"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-client-extension-input\u2460\u2464"},{"id":"ref-for-client-extension-input\u2460\u2465"},{"id":"ref-for-client-extension-input\u2460\u2466"},{"id":"ref-for-client-extension-input\u2460\u2467"}],"title":"9.4. Client Extension Processing"}],"url":"#client-extension-input"},
+"client-extension-output": {"dfnID":"client-extension-output","dfnText":"client extension output","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-output"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client-extension-output\u2460"},{"id":"ref-for-client-extension-output\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension-output\u2462"},{"id":"ref-for-client-extension-output\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension-output\u2464"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-client-extension-output\u2465"},{"id":"ref-for-client-extension-output\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension-output\u2467"},{"id":"ref-for-client-extension-output\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u24ea"},{"id":"ref-for-client-extension-output\u2460\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2461"},{"id":"ref-for-client-extension-output\u2460\u2462"},{"id":"ref-for-client-extension-output\u2460\u2463"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2464"},{"id":"ref-for-client-extension-output\u2460\u2465"},{"id":"ref-for-client-extension-output\u2460\u2466"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension-output\u2460\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#client-extension-output"},
+"client-extension-processing": {"dfnID":"client-extension-processing","dfnText":"Client Extension Processing","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension-processing"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client-extension-processing\u2460"},{"id":"ref-for-client-extension-processing\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension-processing\u2462"},{"id":"ref-for-client-extension-processing\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension-processing\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client-extension-processing\u2465"},{"id":"ref-for-client-extension-processing\u2466"},{"id":"ref-for-client-extension-processing\u2467"},{"id":"ref-for-client-extension-processing\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension-processing\u2460\u24ea"}],"title":"9.2. Defining Extensions"}],"url":"#client-extension-processing"},
+"client-platform": {"dfnID":"client-platform","dfnText":"Client Platform","external":false,"refSections":[{"refs":[{"id":"ref-for-client-platform"},{"id":"ref-for-client-platform\u2460"},{"id":"ref-for-client-platform\u2461"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-platform\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client-platform\u2463"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client-platform\u2464"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-client-platform\u2465"},{"id":"ref-for-client-platform\u2466"},{"id":"ref-for-client-platform\u2467"},{"id":"ref-for-client-platform\u2468"},{"id":"ref-for-client-platform\u2460\u24ea"},{"id":"ref-for-client-platform\u2460\u2460"},{"id":"ref-for-client-platform\u2460\u2461"},{"id":"ref-for-client-platform\u2460\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-platform\u2460\u2463"},{"id":"ref-for-client-platform\u2460\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-client-platform\u2460\u2465"},{"id":"ref-for-client-platform\u2460\u2466"},{"id":"ref-for-client-platform\u2460\u2467"},{"id":"ref-for-client-platform\u2460\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-platform\u2461\u24ea"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-client-platform\u2461\u2460"},{"id":"ref-for-client-platform\u2461\u2461"},{"id":"ref-for-client-platform\u2461\u2462"},{"id":"ref-for-client-platform\u2461\u2463"},{"id":"ref-for-client-platform\u2461\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-platform\u2461\u2465"},{"id":"ref-for-client-platform\u2461\u2466"},{"id":"ref-for-client-platform\u2461\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client-platform\u2461\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client-platform\u2462\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client-platform\u2462\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2461"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2462"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2463"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client-platform\u2462\u2467"},{"id":"ref-for-client-platform\u2462\u2468"},{"id":"ref-for-client-platform\u2463\u24ea"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2460"},{"id":"ref-for-client-platform\u2463\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2462"},{"id":"ref-for-client-platform\u2463\u2463"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2464"},{"id":"ref-for-client-platform\u2463\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client-platform\u2463\u2466"},{"id":"ref-for-client-platform\u2463\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-platform\u2463\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-platform\u2464\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-platform\u2464\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-client-platform\u2464\u2461"},{"id":"ref-for-client-platform\u2464\u2462"},{"id":"ref-for-client-platform\u2464\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-platform\u2464\u2464"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-client-platform\u2464\u2465"},{"id":"ref-for-client-platform\u2464\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#client-platform"},
 "client-side": {"dfnID":"client-side","dfnText":"Client-Side","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side"},{"id":"ref-for-client-side\u2460"},{"id":"ref-for-client-side\u2461"}],"title":"4. Terminology"}],"url":"#client-side"},
-"client-side-credential-storage-modality": {"dfnID":"client-side-credential-storage-modality","dfnText":"client-side credential storage modality","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side-credential-storage-modality"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2460"},{"id":"ref-for-client-side-credential-storage-modality\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2462"},{"id":"ref-for-client-side-credential-storage-modality\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2464"},{"id":"ref-for-client-side-credential-storage-modality\u2465"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#client-side-credential-storage-modality"},
+"client-side-credential-storage-modality": {"dfnID":"client-side-credential-storage-modality","dfnText":"client-side credential storage modality","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side-credential-storage-modality"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2460"},{"id":"ref-for-client-side-credential-storage-modality\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2462"},{"id":"ref-for-client-side-credential-storage-modality\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-side-credential-storage-modality\u2464"},{"id":"ref-for-client-side-credential-storage-modality\u2465"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#client-side-credential-storage-modality"},
 "client-side-discoverable-credential": {"dfnID":"client-side-discoverable-credential","dfnText":"Client-side discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side-discoverable-credential"},{"id":"ref-for-client-side-discoverable-credential\u2460"},{"id":"ref-for-client-side-discoverable-credential\u2461"},{"id":"ref-for-client-side-discoverable-credential\u2462"},{"id":"ref-for-client-side-discoverable-credential\u2463"},{"id":"ref-for-client-side-discoverable-credential\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2466"},{"id":"ref-for-client-side-discoverable-credential\u2467"},{"id":"ref-for-client-side-discoverable-credential\u2468"},{"id":"ref-for-client-side-discoverable-credential\u2460\u24ea"},{"id":"ref-for-client-side-discoverable-credential\u2460\u2460"},{"id":"ref-for-client-side-discoverable-credential\u2460\u2461"},{"id":"ref-for-client-side-discoverable-credential\u2460\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2460\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2460\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2460\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2460\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-client-side-discoverable-credential\u2460\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#client-side-discoverable-credential"},
-"client-side-discoverable-public-key-credential-source": {"dfnID":"client-side-discoverable-public-key-credential-source","dfnText":"Client-side discoverable Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2460"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2462"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2464"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#client-side-discoverable-public-key-credential-source"},
-"collectedclientdata-hash-of-the-serialized-client-data": {"dfnID":"collectedclientdata-hash-of-the-serialized-client-data","dfnText":"Hash of the serialized client data","external":false,"refSections":[{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2466"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2467"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u24ea"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2461"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2464"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2465"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2466"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2467"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2468"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461\u24ea"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461\u2460"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461\u2461"}],"title":"10.2.2.2.2. Attestation calculations"}],"url":"#collectedclientdata-hash-of-the-serialized-client-data"},
-"collectedclientdata-json-compatible-serialization-of-client-data": {"dfnID":"collectedclientdata-json-compatible-serialization-of-client-data","dfnText":"JSON-compatible serialization of client data","external":false,"refSections":[{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2461"},{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2464"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#collectedclientdata-json-compatible-serialization-of-client-data"},
+"client-side-discoverable-public-key-credential-source": {"dfnID":"client-side-discoverable-public-key-credential-source","dfnText":"Client-side discoverable Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2460"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2462"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2464"},{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-client-side-discoverable-public-key-credential-source\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#client-side-discoverable-public-key-credential-source"},
+"collectedclientdata-hash-of-the-serialized-client-data": {"dfnID":"collectedclientdata-hash-of-the-serialized-client-data","dfnText":"Hash of the serialized client data","external":false,"refSections":[{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2466"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2467"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u24ea"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2461"},{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2464"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2465"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2466"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2467"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2460\u2468"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-collectedclientdata-hash-of-the-serialized-client-data\u2461\u24ea"}],"title":"8.8. Apple Anonymous Attestation Statement Format"}],"url":"#collectedclientdata-hash-of-the-serialized-client-data"},
+"collectedclientdata-json-compatible-serialization-of-client-data": {"dfnID":"collectedclientdata-json-compatible-serialization-of-client-data","dfnText":"JSON-compatible serialization of client data","external":false,"refSections":[{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2461"},{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-collectedclientdata-json-compatible-serialization-of-client-data\u2464"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#collectedclientdata-json-compatible-serialization-of-client-data"},
 "concept-user-present": {"dfnID":"concept-user-present","dfnText":"User Present","external":false,"refSections":[{"refs":[{"id":"ref-for-concept-user-present"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-user-present\u2460"},{"id":"ref-for-concept-user-present\u2461"},{"id":"ref-for-concept-user-present\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-concept-user-present\u2463"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"#concept-user-present"},
 "concept-user-verified": {"dfnID":"concept-user-verified","dfnText":"User Verified","external":false,"refSections":[{"refs":[{"id":"ref-for-concept-user-verified"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-user-verified\u2460"},{"id":"ref-for-concept-user-verified\u2461"},{"id":"ref-for-concept-user-verified\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-concept-user-verified\u2463"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#concept-user-verified"},
-"conforming-user-agent": {"dfnID":"conforming-user-agent","dfnText":"Conforming User Agent","external":false,"refSections":[{"refs":[{"id":"ref-for-conforming-user-agent"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-conforming-user-agent\u2460"}],"title":"2.1. User Agents"},{"refs":[{"id":"ref-for-conforming-user-agent\u2461"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-conforming-user-agent\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-conforming-user-agent\u2463"}],"title":"6.4.1. String Truncation"}],"url":"#conforming-user-agent"},
-"contains": {"dfnID":"contains","dfnText":"contains","external":false,"refSections":[{"refs":[{"id":"ref-for-contains"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-contains\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-contains\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#contains"},
+"conforming-user-agent": {"dfnID":"conforming-user-agent","dfnText":"Conforming User Agent","external":false,"refSections":[{"refs":[{"id":"ref-for-conforming-user-agent"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-conforming-user-agent\u2460"}],"title":"2.1. User Agents"},{"refs":[{"id":"ref-for-conforming-user-agent\u2461"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-conforming-user-agent\u2462"}],"title":"4. Terminology"}],"url":"#conforming-user-agent"},
+"contains": {"dfnID":"contains","dfnText":"contains","external":false,"refSections":[{"refs":[{"id":"ref-for-contains"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-contains\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-contains\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-contains\u2462"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#contains"},
 "create-candidate-authenticator": {"dfnID":"create-candidate-authenticator","dfnText":"candidate authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-candidate-authenticator"},{"id":"ref-for-create-candidate-authenticator\u2460"},{"id":"ref-for-create-candidate-authenticator\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-candidate-authenticator"},
 "create-selected-authenticator": {"dfnID":"create-selected-authenticator","dfnText":"selected authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-selected-authenticator"},{"id":"ref-for-create-selected-authenticator\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-selected-authenticator"},
 "created-on": {"dfnID":"created-on","dfnText":"created on","external":false,"refSections":[{"refs":[{"id":"ref-for-created-on"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-created-on\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#created-on"},
 "credential-descriptor-for-a-credential-record": {"dfnID":"credential-descriptor-for-a-credential-record","dfnText":"credential descriptor for a credential record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-descriptor-for-a-credential-record"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-descriptor-for-a-credential-record\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}],"url":"#credential-descriptor-for-a-credential-record"},
-"credential-id": {"dfnID":"credential-id","dfnText":"Credential ID","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-id"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-id\u2460"},{"id":"ref-for-credential-id\u2461"},{"id":"ref-for-credential-id\u2462"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credential-id\u2463"},{"id":"ref-for-credential-id\u2464"},{"id":"ref-for-credential-id\u2465"},{"id":"ref-for-credential-id\u2466"},{"id":"ref-for-credential-id\u2467"},{"id":"ref-for-credential-id\u2468"},{"id":"ref-for-credential-id\u2460\u24ea"},{"id":"ref-for-credential-id\u2460\u2460"},{"id":"ref-for-credential-id\u2460\u2461"},{"id":"ref-for-credential-id\u2460\u2462"},{"id":"ref-for-credential-id\u2460\u2463"},{"id":"ref-for-credential-id\u2460\u2464"},{"id":"ref-for-credential-id\u2460\u2465"},{"id":"ref-for-credential-id\u2460\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-id\u2460\u2467"},{"id":"ref-for-credential-id\u2460\u2468"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-id\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-credential-id\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-credential-id\u2461\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2463"},{"id":"ref-for-credential-id\u2461\u2464"},{"id":"ref-for-credential-id\u2461\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-credential-id\u2461\u2466"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-credential-id\u2461\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-credential-id\u2461\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u24ea"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-id\u2462\u2461"},{"id":"ref-for-credential-id\u2462\u2462"},{"id":"ref-for-credential-id\u2462\u2463"},{"id":"ref-for-credential-id\u2462\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-id\u2462\u2465"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-id\u2462\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-credential-id\u2462\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-credential-id\u2462\u2468"},{"id":"ref-for-credential-id\u2463\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2460"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2461"},{"id":"ref-for-credential-id\u2463\u2462"},{"id":"ref-for-credential-id\u2463\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-id\u2463\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-id\u2463\u2465"},{"id":"ref-for-credential-id\u2463\u2466"},{"id":"ref-for-credential-id\u2463\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-credential-id\u2463\u2468"},{"id":"ref-for-credential-id\u2464\u24ea"},{"id":"ref-for-credential-id\u2464\u2460"},{"id":"ref-for-credential-id\u2464\u2461"},{"id":"ref-for-credential-id\u2464\u2462"},{"id":"ref-for-credential-id\u2464\u2463"},{"id":"ref-for-credential-id\u2464\u2464"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#credential-id"},
+"credential-id": {"dfnID":"credential-id","dfnText":"Credential ID","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-id"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-id\u2460"},{"id":"ref-for-credential-id\u2461"},{"id":"ref-for-credential-id\u2462"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credential-id\u2463"},{"id":"ref-for-credential-id\u2464"},{"id":"ref-for-credential-id\u2465"},{"id":"ref-for-credential-id\u2466"},{"id":"ref-for-credential-id\u2467"},{"id":"ref-for-credential-id\u2468"},{"id":"ref-for-credential-id\u2460\u24ea"},{"id":"ref-for-credential-id\u2460\u2460"},{"id":"ref-for-credential-id\u2460\u2461"},{"id":"ref-for-credential-id\u2460\u2462"},{"id":"ref-for-credential-id\u2460\u2463"},{"id":"ref-for-credential-id\u2460\u2464"},{"id":"ref-for-credential-id\u2460\u2465"},{"id":"ref-for-credential-id\u2460\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-id\u2460\u2467"},{"id":"ref-for-credential-id\u2460\u2468"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-id\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-credential-id\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-credential-id\u2461\u2461"},{"id":"ref-for-credential-id\u2461\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2463"},{"id":"ref-for-credential-id\u2461\u2464"},{"id":"ref-for-credential-id\u2461\u2465"},{"id":"ref-for-credential-id\u2461\u2466"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-id\u2462\u24ea"},{"id":"ref-for-credential-id\u2462\u2460"},{"id":"ref-for-credential-id\u2462\u2461"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-credential-id\u2462\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-credential-id\u2462\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u2466"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-id\u2462\u2467"},{"id":"ref-for-credential-id\u2462\u2468"},{"id":"ref-for-credential-id\u2463\u24ea"},{"id":"ref-for-credential-id\u2463\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-id\u2463\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-id\u2463\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2464"},{"id":"ref-for-credential-id\u2463\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2466"},{"id":"ref-for-credential-id\u2463\u2467"},{"id":"ref-for-credential-id\u2463\u2468"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-id\u2464\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-id\u2464\u2460"},{"id":"ref-for-credential-id\u2464\u2461"},{"id":"ref-for-credential-id\u2464\u2462"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-credential-id\u2464\u2463"},{"id":"ref-for-credential-id\u2464\u2464"},{"id":"ref-for-credential-id\u2464\u2465"},{"id":"ref-for-credential-id\u2464\u2466"},{"id":"ref-for-credential-id\u2464\u2467"},{"id":"ref-for-credential-id\u2464\u2468"},{"id":"ref-for-credential-id\u2465\u24ea"},{"id":"ref-for-credential-id\u2465\u2460"},{"id":"ref-for-credential-id\u2465\u2461"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-credential-id\u2465\u2462"}],"title":"16. Test Vectors"}],"url":"#credential-id"},
 "credential-id-looking-up": {"dfnID":"credential-id-looking-up","dfnText":"looking up","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-id-looking-up"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-credential-id-looking-up\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#credential-id-looking-up"},
-"credential-key-pair": {"dfnID":"credential-key-pair","dfnText":"Credential Key Pair","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-key-pair"},{"id":"ref-for-credential-key-pair\u2460"},{"id":"ref-for-credential-key-pair\u2461"},{"id":"ref-for-credential-key-pair\u2462"},{"id":"ref-for-credential-key-pair\u2463"},{"id":"ref-for-credential-key-pair\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-key-pair\u2465"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-credential-key-pair\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-key-pair"},
+"credential-key-pair": {"dfnID":"credential-key-pair","dfnText":"Credential Key Pair","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-key-pair"},{"id":"ref-for-credential-key-pair\u2460"},{"id":"ref-for-credential-key-pair\u2461"},{"id":"ref-for-credential-key-pair\u2462"},{"id":"ref-for-credential-key-pair\u2463"},{"id":"ref-for-credential-key-pair\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-key-pair\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-key-pair"},
 "credential-parameters": {"dfnID":"credential-parameters","dfnText":"Credential Parameters","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-parameters"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-parameters\u2460"},{"id":"ref-for-credential-parameters\u2461"}],"title":"11.6. Get Credentials"}],"url":"#credential-parameters"},
-"credential-private-key": {"dfnID":"credential-private-key","dfnText":"Credential Private Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-private-key"},{"id":"ref-for-credential-private-key\u2460"},{"id":"ref-for-credential-private-key\u2461"},{"id":"ref-for-credential-private-key\u2462"},{"id":"ref-for-credential-private-key\u2463"},{"id":"ref-for-credential-private-key\u2464"},{"id":"ref-for-credential-private-key\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-private-key\u2466"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-private-key\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-credential-private-key\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u24ea"},{"id":"ref-for-credential-private-key\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2461"},{"id":"ref-for-credential-private-key\u2460\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2463"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2466"},{"id":"ref-for-credential-private-key\u2460\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2468"},{"id":"ref-for-credential-private-key\u2461\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-credential-private-key\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#credential-private-key"},
-"credential-properties": {"dfnID":"credential-properties","dfnText":"Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-properties"},{"id":"ref-for-credential-properties\u2460"},{"id":"ref-for-credential-properties\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-properties\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-properties\u2463"},{"id":"ref-for-credential-properties\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-credential-properties\u2465"},{"id":"ref-for-credential-properties\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-properties\u2467"},{"id":"ref-for-credential-properties\u2468"},{"id":"ref-for-credential-properties\u2460\u24ea"},{"id":"ref-for-credential-properties\u2460\u2460"},{"id":"ref-for-credential-properties\u2460\u2461"}],"title":"11.10. Set Credential Properties"}],"url":"#credential-properties"},
-"credential-public-key": {"dfnID":"credential-public-key","dfnText":"Credential Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-public-key"},{"id":"ref-for-credential-public-key\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-public-key\u2461"},{"id":"ref-for-credential-public-key\u2462"},{"id":"ref-for-credential-public-key\u2463"},{"id":"ref-for-credential-public-key\u2464"},{"id":"ref-for-credential-public-key\u2465"},{"id":"ref-for-credential-public-key\u2466"},{"id":"ref-for-credential-public-key\u2467"},{"id":"ref-for-credential-public-key\u2468"},{"id":"ref-for-credential-public-key\u2460\u24ea"},{"id":"ref-for-credential-public-key\u2460\u2460"},{"id":"ref-for-credential-public-key\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2463"},{"id":"ref-for-credential-public-key\u2460\u2464"},{"id":"ref-for-credential-public-key\u2460\u2465"},{"id":"ref-for-credential-public-key\u2460\u2466"},{"id":"ref-for-credential-public-key\u2460\u2467"},{"id":"ref-for-credential-public-key\u2460\u2468"},{"id":"ref-for-credential-public-key\u2461\u24ea"},{"id":"ref-for-credential-public-key\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2461"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2463"},{"id":"ref-for-credential-public-key\u2461\u2464"},{"id":"ref-for-credential-public-key\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2466"},{"id":"ref-for-credential-public-key\u2461\u2467"},{"id":"ref-for-credential-public-key\u2461\u2468"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u24ea"},{"id":"ref-for-credential-public-key\u2462\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2462"},{"id":"ref-for-credential-public-key\u2462\u2463"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2465"},{"id":"ref-for-credential-public-key\u2462\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2468"},{"id":"ref-for-credential-public-key\u2463\u24ea"},{"id":"ref-for-credential-public-key\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-public-key"},
-"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"},{"id":"ref-for-credential-record\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"},{"id":"ref-for-credential-record\u2468"},{"id":"ref-for-credential-record\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-record\u2460\u2460"},{"id":"ref-for-credential-record\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2460\u2462"},{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"},{"id":"ref-for-credential-record\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-record\u2460\u2467"},{"id":"ref-for-credential-record\u2460\u2468"},{"id":"ref-for-credential-record\u2461\u24ea"},{"id":"ref-for-credential-record\u2461\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-record\u2461\u2461"},{"id":"ref-for-credential-record\u2461\u2462"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-credential-record\u2461\u2463"}],"title":"10.2.2.3.1. Registration (create())"}],"url":"#credential-record"},
-"credential-record-supplemental-public-key-record": {"dfnID":"credential-record-supplemental-public-key-record","dfnText":"supplemental public key record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record\u2460"},{"id":"ref-for-credential-record-supplemental-public-key-record\u2461"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record\u2462"},{"id":"ref-for-credential-record-supplemental-public-key-record\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#credential-record-supplemental-public-key-record"},
+"credential-private-key": {"dfnID":"credential-private-key","dfnText":"Credential Private Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-private-key"},{"id":"ref-for-credential-private-key\u2460"},{"id":"ref-for-credential-private-key\u2461"},{"id":"ref-for-credential-private-key\u2462"},{"id":"ref-for-credential-private-key\u2463"},{"id":"ref-for-credential-private-key\u2464"},{"id":"ref-for-credential-private-key\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-private-key\u2466"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-private-key\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-credential-private-key\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u24ea"},{"id":"ref-for-credential-private-key\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2461"},{"id":"ref-for-credential-private-key\u2460\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2463"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2466"},{"id":"ref-for-credential-private-key\u2460\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2468"},{"id":"ref-for-credential-private-key\u2461\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-credential-private-key\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-private-key\u2461\u2461"}],"title":"16. Test Vectors"}],"url":"#credential-private-key"},
+"credential-properties": {"dfnID":"credential-properties","dfnText":"Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-properties"},{"id":"ref-for-credential-properties\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-properties\u2461"},{"id":"ref-for-credential-properties\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-properties\u2463"},{"id":"ref-for-credential-properties\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-credential-properties\u2465"},{"id":"ref-for-credential-properties\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-properties\u2467"},{"id":"ref-for-credential-properties\u2468"},{"id":"ref-for-credential-properties\u2460\u24ea"},{"id":"ref-for-credential-properties\u2460\u2460"},{"id":"ref-for-credential-properties\u2460\u2461"}],"title":"11.10. Set Credential Properties"}],"url":"#credential-properties"},
+"credential-public-key": {"dfnID":"credential-public-key","dfnText":"Credential Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-public-key"},{"id":"ref-for-credential-public-key\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-public-key\u2461"},{"id":"ref-for-credential-public-key\u2462"},{"id":"ref-for-credential-public-key\u2463"},{"id":"ref-for-credential-public-key\u2464"},{"id":"ref-for-credential-public-key\u2465"},{"id":"ref-for-credential-public-key\u2466"},{"id":"ref-for-credential-public-key\u2467"},{"id":"ref-for-credential-public-key\u2468"},{"id":"ref-for-credential-public-key\u2460\u24ea"},{"id":"ref-for-credential-public-key\u2460\u2460"},{"id":"ref-for-credential-public-key\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2463"},{"id":"ref-for-credential-public-key\u2460\u2464"},{"id":"ref-for-credential-public-key\u2460\u2465"},{"id":"ref-for-credential-public-key\u2460\u2466"},{"id":"ref-for-credential-public-key\u2460\u2467"},{"id":"ref-for-credential-public-key\u2460\u2468"},{"id":"ref-for-credential-public-key\u2461\u24ea"},{"id":"ref-for-credential-public-key\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2461"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2463"},{"id":"ref-for-credential-public-key\u2461\u2464"},{"id":"ref-for-credential-public-key\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2466"},{"id":"ref-for-credential-public-key\u2461\u2467"},{"id":"ref-for-credential-public-key\u2461\u2468"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u24ea"},{"id":"ref-for-credential-public-key\u2462\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2462"},{"id":"ref-for-credential-public-key\u2462\u2463"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2465"},{"id":"ref-for-credential-public-key\u2462\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2468"},{"id":"ref-for-credential-public-key\u2463\u24ea"},{"id":"ref-for-credential-public-key\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-credential-public-key\u2463\u2461"}],"title":"16. Test Vectors"}],"url":"#credential-public-key"},
+"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2465"},{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"},{"id":"ref-for-credential-record\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-record\u2460\u24ea"},{"id":"ref-for-credential-record\u2460\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2460\u2461"},{"id":"ref-for-credential-record\u2460\u2462"},{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#credential-record"},
 "credential-storage-modality": {"dfnID":"credential-storage-modality","dfnText":"credential storage\nmodality","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-storage-modality"},{"id":"ref-for-credential-storage-modality\u2460"},{"id":"ref-for-credential-storage-modality\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#credential-storage-modality"},
-"credentialcreationdata-attestationconveyancepreferenceoption": {"dfnID":"credentialcreationdata-attestationconveyancepreferenceoption","dfnText":"attestationConveyancePreferenceOption","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationconveyancepreferenceoption"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
-"credentialcreationdata-attestationobjectresult": {"dfnID":"credentialcreationdata-attestationobjectresult","dfnText":"attestationObjectResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationobjectresult"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2460"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2461"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2462"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#credentialcreationdata-attestationobjectresult"},
-"credentialcreationdata-clientdatajsonresult": {"dfnID":"credentialcreationdata-clientdatajsonresult","dfnText":"clientDataJSONResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientdatajsonresult"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#credentialcreationdata-clientdatajsonresult"},
-"credentialcreationdata-clientextensionresults": {"dfnID":"credentialcreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#credentialcreationdata-clientextensionresults"},
+"credentialcreationdata-attestationconveyancepreferenceoption": {"dfnID":"credentialcreationdata-attestationconveyancepreferenceoption","dfnText":"attestationConveyancePreferenceOption","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationconveyancepreferenceoption"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
+"credentialcreationdata-attestationobjectresult": {"dfnID":"credentialcreationdata-attestationobjectresult","dfnText":"attestationObjectResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationobjectresult"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2460"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2461"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2462"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-attestationobjectresult"},
+"credentialcreationdata-clientdatajsonresult": {"dfnID":"credentialcreationdata-clientdatajsonresult","dfnText":"clientDataJSONResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientdatajsonresult"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-clientdatajsonresult"},
+"credentialcreationdata-clientextensionresults": {"dfnID":"credentialcreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#credentialcreationdata-clientextensionresults"},
+"credentialpropertiesoutput-client-side-discoverable-credential-property": {"dfnID":"credentialpropertiesoutput-client-side-discoverable-credential-property","dfnText":"client-side discoverable credential property","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#credentialpropertiesoutput-client-side-discoverable-credential-property"},
 "credentialpropertiesoutput-resident-key-credential-property": {"dfnID":"credentialpropertiesoutput-resident-key-credential-property","dfnText":"resident key credential property","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialpropertiesoutput-resident-key-credential-property"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credentialpropertiesoutput-resident-key-credential-property"},
-"credprops": {"dfnID":"credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-credprops"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credprops\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credprops\u2461"},{"id":"ref-for-credprops\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credprops"},
+"credprops": {"dfnID":"credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-credprops"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credprops\u2460"},{"id":"ref-for-credprops\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credprops"},
 "cross-platform-attachment": {"dfnID":"cross-platform-attachment","dfnText":"cross-platform attachment","external":false,"refSections":[{"refs":[{"id":"ref-for-cross-platform-attachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2461"},{"id":"ref-for-cross-platform-attachment\u2462"},{"id":"ref-for-cross-platform-attachment\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2464"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2465"}],"title":"11.2. Virtual Authenticators"}],"url":"#cross-platform-attachment"},
 "d0140610": {"dfnID":"d0140610","dfnText":"remote","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discovery-remote"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote"},
+"d0b4a948": {"dfnID":"d0b4a948","dfnText":"a promise rejected with","external":true,"refSections":[{"refs":[{"id":"ref-for-a-promise-rejected-with"},{"id":"ref-for-a-promise-rejected-with\u2460"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2462"},{"id":"ref-for-a-promise-rejected-with\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2464"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"https://webidl.spec.whatwg.org/#a-promise-rejected-with"},
 "d14a6f26": {"dfnID":"d14a6f26","dfnText":"key","external":true,"refSections":[{"refs":[{"id":"ref-for-map-key"},{"id":"ref-for-map-key\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-key"},
-"d18b257e": {"dfnID":"d18b257e","dfnText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot"},
-"d3801403": {"dfnID":"d3801403","dfnText":"\u00a76. authenticator api","external":true,"refSections":[{"refs":[{"id":"ref-for-authenticator-api"}],"title":"6. WebAuthn Authenticator Model"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
-"d3ddece3": {"dfnID":"d3ddece3","dfnText":"group sockets","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.9"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-section-3.9\u2460"},{"id":"ref-for-section-3.9\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://tools.ietf.org/html/rfc8610#section-3.9"},
-"d6e2b0d9": {"dfnID":"d6e2b0d9","dfnText":"ipv6 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv6"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-ipv6\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv6"},
-"d74c0894": {"dfnID":"d74c0894","dfnText":"non-autofill credential type","external":true,"refSections":[{"refs":[{"id":"ref-for-non-autofill-credential-type"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type"},
+"d18b257e": {"dfnID":"d18b257e","dfnText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot"},
+"d25dfb2c": {"dfnID":"d25dfb2c","dfnText":"AbortError","external":true,"refSections":[{"refs":[{"id":"ref-for-aborterror"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-aborterror\u2460"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://webidl.spec.whatwg.org/#aborterror"},
+"d3801403": {"dfnID":"d3801403","dfnText":"\u00a76. Authenticator API","external":true,"refSections":[{"refs":[{"id":"ref-for-authenticator-api"}],"title":"6. WebAuthn Authenticator Model"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
+"d3ddece3": {"dfnID":"d3ddece3","dfnText":"group sockets","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.9"}],"title":"9.3. Extending Request Parameters"}],"url":"https://tools.ietf.org/html/rfc8610#section-3.9"},
+"d6e2b0d9": {"dfnID":"d6e2b0d9","dfnText":"IPv6 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv6"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-ipv6\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv6"},
+"d74c0894": {"dfnID":"d74c0894","dfnText":"non-autofill credential type","external":true,"refSections":[{"refs":[{"id":"ref-for-non-autofill-credential-type"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type"},
 "d78cb661": {"dfnID":"d78cb661","dfnText":"validating capabilities","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-validate-capabilities"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-validate-capabilities\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"https://w3c.github.io/webdriver/#dfn-validate-capabilities"},
-"d7d642a2": {"dfnID":"d7d642a2","dfnText":"input","external":true,"refSections":[{"refs":[{"id":"ref-for-the-input-element"},{"id":"ref-for-the-input-element\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/input.html#the-input-element"},
-"d9070155": {"dfnID":"d9070155","dfnText":"CredentialRequestOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions"},{"id":"ref-for-dictdef-credentialrequestoptions\u2460"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
-"dbde7f99": {"dfnID":"dbde7f99","dfnText":"ipv4 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv4"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-ipv4\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv4"},
-"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"},{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2461"},{"id":"ref-for-idl-DOMException\u2460\u2462"},{"id":"ref-for-idl-DOMException\u2460\u2463"},{"id":"ref-for-idl-DOMException\u2460\u2464"},{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2467"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2464"},{"id":"ref-for-idl-DOMException\u2461\u2465"},{"id":"ref-for-idl-DOMException\u2461\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2467"},{"id":"ref-for-idl-DOMException\u2461\u2468"},{"id":"ref-for-idl-DOMException\u2462\u24ea"},{"id":"ref-for-idl-DOMException\u2462\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
-"dd460c8e": {"dfnID":"dd460c8e","dfnText":"is not empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
-"determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised": {"dfnID":"determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised","dfnText":"determines the set of origins on which the public key credential may be exercised","external":false,"refSections":[{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2460"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2461"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2462"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2464"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2465"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2466"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},
-"df6ef2f0": {"dfnID":"df6ef2f0","dfnText":"section 2","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2\u2460"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-2"},
-"dictdef-authenticationextensionsclientinputs": {"dfnID":"dictdef-authenticationextensionsclientinputs","dfnText":"AuthenticationExtensionsClientInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs"},{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2461"},{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2463"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2464"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2466"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2468"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460\u2460"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dictdef-authenticationextensionsclientinputs"},
+"d7d642a2": {"dfnID":"d7d642a2","dfnText":"input","external":true,"refSections":[{"refs":[{"id":"ref-for-the-input-element"},{"id":"ref-for-the-input-element\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/input.html#the-input-element"},
+"d9070155": {"dfnID":"d9070155","dfnText":"CredentialRequestOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions"},{"id":"ref-for-dictdef-credentialrequestoptions\u2460"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
+"dacde8b5": {"dfnID":"dacde8b5","dfnText":"a new promise","external":true,"refSections":[{"refs":[{"id":"ref-for-a-new-promise"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#a-new-promise"},
+"dbde7f99": {"dfnID":"dbde7f99","dfnText":"IPv4 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv4"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-ipv4\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv4"},
+"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"},{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"},{"id":"ref-for-idl-DOMException\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2463"},{"id":"ref-for-idl-DOMException\u2460\u2464"},{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"},{"id":"ref-for-idl-DOMException\u2460\u2467"},{"id":"ref-for-idl-DOMException\u2460\u2468"},{"id":"ref-for-idl-DOMException\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2462"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2466"},{"id":"ref-for-idl-DOMException\u2461\u2467"},{"id":"ref-for-idl-DOMException\u2461\u2468"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u24ea"},{"id":"ref-for-idl-DOMException\u2462\u2460"},{"id":"ref-for-idl-DOMException\u2462\u2461"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2464"},{"id":"ref-for-idl-DOMException\u2462\u2465"},{"id":"ref-for-idl-DOMException\u2462\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2467"},{"id":"ref-for-idl-DOMException\u2462\u2468"},{"id":"ref-for-idl-DOMException\u2463\u24ea"},{"id":"ref-for-idl-DOMException\u2463\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
+"dd460c8e": {"dfnID":"dd460c8e","dfnText":"is not empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
+"determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised": {"dfnID":"determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised","dfnText":"determines the set of origins on which the public key credential may be exercised","external":false,"refSections":[{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2460"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2461"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2462"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2464"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2465"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2466"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2467"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2468"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2460\u24ea"}],"title":"13.4.8. Code injection attacks"}],"url":"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},
+"df6ef2f0": {"dfnID":"df6ef2f0","dfnText":"Section 2","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2\u2460"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-2"},
+"dictdef-allacceptedcredentialsoptions": {"dfnID":"dictdef-allacceptedcredentialsoptions","dfnText":"AllAcceptedCredentialsOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-allacceptedcredentialsoptions"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-dictdef-allacceptedcredentialsoptions\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"#dictdef-allacceptedcredentialsoptions"},
+"dictdef-authenticationextensionsclientinputs": {"dfnID":"dictdef-authenticationextensionsclientinputs","dfnText":"AuthenticationExtensionsClientInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs"},{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2461"},{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2463"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2464"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2466"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2468"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputs\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dictdef-authenticationextensionsclientinputs"},
 "dictdef-authenticationextensionsclientinputsjson": {"dfnID":"dictdef-authenticationextensionsclientinputsjson","dfnText":"AuthenticationExtensionsClientInputsJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputsjson"},{"id":"ref-for-dictdef-authenticationextensionsclientinputsjson\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientinputsjson\u2461"},{"id":"ref-for-dictdef-authenticationextensionsclientinputsjson\u2462"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#dictdef-authenticationextensionsclientinputsjson"},
-"dictdef-authenticationextensionsclientoutputs": {"dfnID":"dictdef-authenticationextensionsclientoutputs","dfnText":"AuthenticationExtensionsClientOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2462"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2463"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2468"},{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460\u2460"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dictdef-authenticationextensionsclientoutputs"},
+"dictdef-authenticationextensionsclientoutputs": {"dfnID":"dictdef-authenticationextensionsclientoutputs","dfnText":"AuthenticationExtensionsClientOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2462"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2463"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2468"},{"id":"ref-for-dictdef-authenticationextensionsclientoutputs\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dictdef-authenticationextensionsclientoutputs"},
 "dictdef-authenticationextensionsclientoutputsjson": {"dfnID":"dictdef-authenticationextensionsclientoutputsjson","dfnText":"AuthenticationExtensionsClientOutputsJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsclientoutputsjson"},{"id":"ref-for-dictdef-authenticationextensionsclientoutputsjson\u2460"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticationextensionsclientoutputsjson"},
 "dictdef-authenticationextensionslargeblobinputs": {"dfnID":"dictdef-authenticationextensionslargeblobinputs","dfnText":"AuthenticationExtensionsLargeBlobInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionslargeblobinputs"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dictdef-authenticationextensionslargeblobinputs"},
 "dictdef-authenticationextensionslargebloboutputs": {"dfnID":"dictdef-authenticationextensionslargebloboutputs","dfnText":"AuthenticationExtensionsLargeBlobOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionslargebloboutputs"},{"id":"ref-for-dictdef-authenticationextensionslargebloboutputs\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dictdef-authenticationextensionslargebloboutputs"},
 "dictdef-authenticationextensionsprfinputs": {"dfnID":"dictdef-authenticationextensionsprfinputs","dfnText":"AuthenticationExtensionsPRFInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfinputs"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfinputs"},
 "dictdef-authenticationextensionsprfoutputs": {"dfnID":"dictdef-authenticationextensionsprfoutputs","dfnText":"AuthenticationExtensionsPRFOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfoutputs"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfoutputs"},
 "dictdef-authenticationextensionsprfvalues": {"dfnID":"dictdef-authenticationextensionsprfvalues","dfnText":"AuthenticationExtensionsPRFValues","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfvalues"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2460"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2461"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2462"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2463"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfvalues"},
-"dictdef-authenticationextensionssupplementalpubkeysinputs": {"dfnID":"dictdef-authenticationextensionssupplementalpubkeysinputs","dfnText":"AuthenticationExtensionsSupplementalPubKeysInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionssupplementalpubkeysinputs"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dictdef-authenticationextensionssupplementalpubkeysinputs"},
-"dictdef-authenticationextensionssupplementalpubkeysoutputs": {"dfnID":"dictdef-authenticationextensionssupplementalpubkeysoutputs","dfnText":"AuthenticationExtensionsSupplementalPubKeysOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionssupplementalpubkeysoutputs"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dictdef-authenticationextensionssupplementalpubkeysoutputs"},
-"dictdef-authenticationresponsejson": {"dfnID":"dictdef-authenticationresponsejson","dfnText":"AuthenticationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticationresponsejson"},
+"dictdef-authenticationresponsejson": {"dfnID":"dictdef-authenticationresponsejson","dfnText":"AuthenticationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationresponsejson"},
 "dictdef-authenticatorassertionresponsejson": {"dfnID":"dictdef-authenticatorassertionresponsejson","dfnText":"AuthenticatorAssertionResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorassertionresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticatorassertionresponsejson"},
 "dictdef-authenticatorattestationresponsejson": {"dfnID":"dictdef-authenticatorattestationresponsejson","dfnText":"AuthenticatorAttestationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorattestationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticatorattestationresponsejson"},
 "dictdef-authenticatorselectioncriteria": {"dfnID":"dictdef-authenticatorselectioncriteria","dfnText":"AuthenticatorSelectionCriteria","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2460"},{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2462"},{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}],"url":"#dictdef-authenticatorselectioncriteria"},
-"dictdef-collectedclientdata": {"dfnID":"dictdef-collectedclientdata","dfnText":"CollectedClientData","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-collectedclientdata"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2461"},{"id":"ref-for-dictdef-collectedclientdata\u2462"},{"id":"ref-for-dictdef-collectedclientdata\u2463"},{"id":"ref-for-dictdef-collectedclientdata\u2464"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2465"},{"id":"ref-for-dictdef-collectedclientdata\u2466"},{"id":"ref-for-dictdef-collectedclientdata\u2467"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2468"},{"id":"ref-for-dictdef-collectedclientdata\u2460\u24ea"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2460\u2460"},{"id":"ref-for-dictdef-collectedclientdata\u2460\u2461"}],"title":"5.8.1.3. Future development"}],"url":"#dictdef-collectedclientdata"},
+"dictdef-collectedclientdata": {"dfnID":"dictdef-collectedclientdata","dfnText":"CollectedClientData","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-collectedclientdata"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2461"},{"id":"ref-for-dictdef-collectedclientdata\u2462"},{"id":"ref-for-dictdef-collectedclientdata\u2463"},{"id":"ref-for-dictdef-collectedclientdata\u2464"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2465"},{"id":"ref-for-dictdef-collectedclientdata\u2466"},{"id":"ref-for-dictdef-collectedclientdata\u2467"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2468"},{"id":"ref-for-dictdef-collectedclientdata\u2460\u24ea"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-collectedclientdata\u2460\u2460"},{"id":"ref-for-dictdef-collectedclientdata\u2460\u2461"}],"title":"5.8.1.3. Future development"}],"url":"#dictdef-collectedclientdata"},
 "dictdef-credentialpropertiesoutput": {"dfnID":"dictdef-credentialpropertiesoutput","dfnText":"CredentialPropertiesOutput","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialpropertiesoutput"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dictdef-credentialpropertiesoutput"},
-"dictdef-publickeycredentialcreationoptions": {"dfnID":"dictdef-publickeycredentialcreationoptions","dfnText":"PublicKeyCredentialCreationOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2461"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2462"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2463"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2467"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2468"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2462"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dictdef-publickeycredentialcreationoptions"},
+"dictdef-currentuserdetailsoptions": {"dfnID":"dictdef-currentuserdetailsoptions","dfnText":"CurrentUserDetailsOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-currentuserdetailsoptions"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-dictdef-currentuserdetailsoptions\u2460"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dictdef-currentuserdetailsoptions"},
+"dictdef-publickeycredentialcreationoptions": {"dfnID":"dictdef-publickeycredentialcreationoptions","dfnText":"PublicKeyCredentialCreationOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2461"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2462"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2463"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2467"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2468"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dictdef-publickeycredentialcreationoptions"},
 "dictdef-publickeycredentialcreationoptionsjson": {"dfnID":"dictdef-publickeycredentialcreationoptionsjson","dfnText":"PublicKeyCredentialCreationOptionsJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptionsjson"},{"id":"ref-for-dictdef-publickeycredentialcreationoptionsjson\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}],"url":"#dictdef-publickeycredentialcreationoptionsjson"},
-"dictdef-publickeycredentialdescriptor": {"dfnID":"dictdef-publickeycredentialdescriptor","dfnText":"PublicKeyCredentialDescriptor","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2461"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2462"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2464"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2466"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2468"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"#dictdef-publickeycredentialdescriptor"},
+"dictdef-publickeycredentialdescriptor": {"dfnID":"dictdef-publickeycredentialdescriptor","dfnText":"PublicKeyCredentialDescriptor","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2461"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2462"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2464"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2466"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2468"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"#dictdef-publickeycredentialdescriptor"},
 "dictdef-publickeycredentialdescriptorjson": {"dfnID":"dictdef-publickeycredentialdescriptorjson","dfnText":"PublicKeyCredentialDescriptorJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptorjson"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptorjson\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#dictdef-publickeycredentialdescriptorjson"},
 "dictdef-publickeycredentialentity": {"dfnID":"dictdef-publickeycredentialentity","dfnText":"PublicKeyCredentialEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity"},{"id":"ref-for-dictdef-publickeycredentialentity\u2460"},{"id":"ref-for-dictdef-publickeycredentialentity\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity\u2462"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"#dictdef-publickeycredentialentity"},
 "dictdef-publickeycredentialparameters": {"dfnID":"dictdef-publickeycredentialparameters","dfnText":"PublicKeyCredentialParameters","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters\u2460"},{"id":"ref-for-dictdef-publickeycredentialparameters\u2461"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters\u2462"},{"id":"ref-for-dictdef-publickeycredentialparameters\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dictdef-publickeycredentialparameters"},
-"dictdef-publickeycredentialrequestoptions": {"dfnID":"dictdef-publickeycredentialrequestoptions","dfnText":"PublicKeyCredentialRequestOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2461"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2463"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2464"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2465"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2467"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u24ea"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2462"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2463"}],"title":"14.6.2. Username Enumeration"}],"url":"#dictdef-publickeycredentialrequestoptions"},
+"dictdef-publickeycredentialrequestoptions": {"dfnID":"dictdef-publickeycredentialrequestoptions","dfnText":"PublicKeyCredentialRequestOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2461"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2463"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2464"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2465"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2467"},{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u24ea"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2461"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2462"}],"title":"14.6.2. Username Enumeration"}],"url":"#dictdef-publickeycredentialrequestoptions"},
 "dictdef-publickeycredentialrequestoptionsjson": {"dfnID":"dictdef-publickeycredentialrequestoptionsjson","dfnText":"PublicKeyCredentialRequestOptionsJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialrequestoptionsjson"},{"id":"ref-for-dictdef-publickeycredentialrequestoptionsjson\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#dictdef-publickeycredentialrequestoptionsjson"},
 "dictdef-publickeycredentialrpentity": {"dfnID":"dictdef-publickeycredentialrpentity","dfnText":"PublicKeyCredentialRpEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2460"},{"id":"ref-for-dictdef-publickeycredentialrpentity\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2463"},{"id":"ref-for-dictdef-publickeycredentialrpentity\u2464"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dictdef-publickeycredentialrpentity"},
-"dictdef-publickeycredentialuserentity": {"dfnID":"dictdef-publickeycredentialuserentity","dfnText":"PublicKeyCredentialUserEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2462"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2465"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dictdef-publickeycredentialuserentity"},
+"dictdef-publickeycredentialuserentity": {"dfnID":"dictdef-publickeycredentialuserentity","dfnText":"PublicKeyCredentialUserEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2462"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2465"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2466"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2468"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dictdef-publickeycredentialuserentity"},
 "dictdef-publickeycredentialuserentityjson": {"dfnID":"dictdef-publickeycredentialuserentityjson","dfnText":"PublicKeyCredentialUserEntityJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentityjson"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}],"url":"#dictdef-publickeycredentialuserentityjson"},
-"dictdef-registrationresponsejson": {"dfnID":"dictdef-registrationresponsejson","dfnText":"RegistrationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-registrationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-registrationresponsejson"},
+"dictdef-registrationresponsejson": {"dfnID":"dictdef-registrationresponsejson","dfnText":"RegistrationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-registrationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-registrationresponsejson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-registrationresponsejson"},
 "dictdef-tokenbinding": {"dfnID":"dictdef-tokenbinding","dfnText":"TokenBinding","external":false,"refSections":[],"url":"#dictdef-tokenbinding"},
-"discoverable-credential": {"dfnID":"discoverable-credential","dfnText":"Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverable-credential"},{"id":"ref-for-discoverable-credential\u2460"},{"id":"ref-for-discoverable-credential\u2461"},{"id":"ref-for-discoverable-credential\u2462"},{"id":"ref-for-discoverable-credential\u2463"},{"id":"ref-for-discoverable-credential\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-discoverable-credential\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-discoverable-credential\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-discoverable-credential\u2468"},{"id":"ref-for-discoverable-credential\u2460\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2460"},{"id":"ref-for-discoverable-credential\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2464"},{"id":"ref-for-discoverable-credential\u2460\u2465"},{"id":"ref-for-discoverable-credential\u2460\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2467"},{"id":"ref-for-discoverable-credential\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#discoverable-credential"},
+"dictdef-unknowncredentialoptions": {"dfnID":"dictdef-unknowncredentialoptions","dfnText":"UnknownCredentialOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-unknowncredentialoptions"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-dictdef-unknowncredentialoptions\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"}],"url":"#dictdef-unknowncredentialoptions"},
+"discoverable-credential": {"dfnID":"discoverable-credential","dfnText":"Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverable-credential"},{"id":"ref-for-discoverable-credential\u2460"},{"id":"ref-for-discoverable-credential\u2461"},{"id":"ref-for-discoverable-credential\u2462"},{"id":"ref-for-discoverable-credential\u2463"},{"id":"ref-for-discoverable-credential\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-discoverable-credential\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-discoverable-credential\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-discoverable-credential\u2468"},{"id":"ref-for-discoverable-credential\u2460\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2460"},{"id":"ref-for-discoverable-credential\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2465"},{"id":"ref-for-discoverable-credential\u2460\u2466"},{"id":"ref-for-discoverable-credential\u2460\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2468"},{"id":"ref-for-discoverable-credential\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#discoverable-credential"},
 "discoverable-credential-capable": {"dfnID":"discoverable-credential-capable","dfnText":"discoverable\ncredential capable","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverable-credential-capable"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-discoverable-credential-capable\u2460"},{"id":"ref-for-discoverable-credential-capable\u2461"},{"id":"ref-for-discoverable-credential-capable\u2462"},{"id":"ref-for-discoverable-credential-capable\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-discoverable-credential-capable\u2464"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#discoverable-credential-capable"},
-"discoverablecredentialmetadata": {"dfnID":"discoverablecredentialmetadata","dfnText":"DiscoverableCredentialMetadata","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata"},{"id":"ref-for-discoverablecredentialmetadata\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-discoverablecredentialmetadata\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#discoverablecredentialmetadata"},
-"discoverablecredentialmetadata-id": {"dfnID":"discoverablecredentialmetadata-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-id"},{"id":"ref-for-discoverablecredentialmetadata-id\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#discoverablecredentialmetadata-id"},
-"discoverablecredentialmetadata-otherui": {"dfnID":"discoverablecredentialmetadata-otherui","dfnText":"otherUI","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-otherui"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#discoverablecredentialmetadata-otherui"},
-"discoverablecredentialmetadata-type": {"dfnID":"discoverablecredentialmetadata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-type"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#discoverablecredentialmetadata-type"},
-"dom-attestationconveyancepreference-direct": {"dfnID":"dom-attestationconveyancepreference-direct","dfnText":"direct","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-direct"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-direct\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}],"url":"#dom-attestationconveyancepreference-direct"},
-"dom-attestationconveyancepreference-enterprise": {"dfnID":"dom-attestationconveyancepreference-enterprise","dfnText":"enterprise","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise"},{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-attestationconveyancepreference-enterprise"},
-"dom-attestationconveyancepreference-indirect": {"dfnID":"dom-attestationconveyancepreference-indirect","dfnText":"indirect","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-indirect"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-indirect\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-indirect\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dom-attestationconveyancepreference-indirect"},
-"dom-attestationconveyancepreference-none": {"dfnID":"dom-attestationconveyancepreference-none","dfnText":"none","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none"},{"id":"ref-for-dom-attestationconveyancepreference-none\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2463"}],"title":"6.5.3. Attestation Types"}],"url":"#dom-attestationconveyancepreference-none"},
+"discoverablecredentialmetadata": {"dfnID":"discoverablecredentialmetadata","dfnText":"DiscoverableCredentialMetadata","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata"},{"id":"ref-for-discoverablecredentialmetadata\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-discoverablecredentialmetadata\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#discoverablecredentialmetadata"},
+"discoverablecredentialmetadata-id": {"dfnID":"discoverablecredentialmetadata-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-id"},{"id":"ref-for-discoverablecredentialmetadata-id\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#discoverablecredentialmetadata-id"},
+"discoverablecredentialmetadata-otherui": {"dfnID":"discoverablecredentialmetadata-otherui","dfnText":"otherUI","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-otherui"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#discoverablecredentialmetadata-otherui"},
+"discoverablecredentialmetadata-type": {"dfnID":"discoverablecredentialmetadata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverablecredentialmetadata-type"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#discoverablecredentialmetadata-type"},
+"dom-allacceptedcredentialsoptions-allacceptedcredentialids": {"dfnID":"dom-allacceptedcredentialsoptions-allacceptedcredentialids","dfnText":"allAcceptedCredentialIds","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids"},{"id":"ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids\u2460"},{"id":"ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids\u2461"},{"id":"ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"#dom-allacceptedcredentialsoptions-allacceptedcredentialids"},
+"dom-allacceptedcredentialsoptions-rpid": {"dfnID":"dom-allacceptedcredentialsoptions-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-allacceptedcredentialsoptions-rpid"},{"id":"ref-for-dom-allacceptedcredentialsoptions-rpid\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"#dom-allacceptedcredentialsoptions-rpid"},
+"dom-allacceptedcredentialsoptions-userid": {"dfnID":"dom-allacceptedcredentialsoptions-userid","dfnText":"userId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-allacceptedcredentialsoptions-userid"},{"id":"ref-for-dom-allacceptedcredentialsoptions-userid\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"#dom-allacceptedcredentialsoptions-userid"},
+"dom-attestationconveyancepreference-direct": {"dfnID":"dom-attestationconveyancepreference-direct","dfnText":"direct","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-direct"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-direct\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}],"url":"#dom-attestationconveyancepreference-direct"},
+"dom-attestationconveyancepreference-enterprise": {"dfnID":"dom-attestationconveyancepreference-enterprise","dfnText":"enterprise","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise"},{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-enterprise\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-attestationconveyancepreference-enterprise"},
+"dom-attestationconveyancepreference-indirect": {"dfnID":"dom-attestationconveyancepreference-indirect","dfnText":"indirect","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-indirect"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-indirect\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}],"url":"#dom-attestationconveyancepreference-indirect"},
+"dom-attestationconveyancepreference-none": {"dfnID":"dom-attestationconveyancepreference-none","dfnText":"none","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none"},{"id":"ref-for-dom-attestationconveyancepreference-none\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-dom-attestationconveyancepreference-none\u2463"}],"title":"6.5.3. Attestation Types"}],"url":"#dom-attestationconveyancepreference-none"},
 "dom-authenticationextensionsclientinputs-appid": {"dfnID":"dom-authenticationextensionsclientinputs-appid","dfnText":"appid","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientinputs-appid"},{"id":"ref-for-dom-authenticationextensionsclientinputs-appid\u2460"},{"id":"ref-for-dom-authenticationextensionsclientinputs-appid\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-authenticationextensionsclientinputs-appid"},
 "dom-authenticationextensionsclientinputs-appidexclude": {"dfnID":"dom-authenticationextensionsclientinputs-appidexclude","dfnText":"appidExclude","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientinputs-appidexclude"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"#dom-authenticationextensionsclientinputs-appidexclude"},
 "dom-authenticationextensionsclientinputs-credprops": {"dfnID":"dom-authenticationextensionsclientinputs-credprops","dfnText":"credProps","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientinputs-credprops"},
 "dom-authenticationextensionsclientinputs-largeblob": {"dfnID":"dom-authenticationextensionsclientinputs-largeblob","dfnText":"largeBlob","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientinputs-largeblob"},
 "dom-authenticationextensionsclientinputs-prf": {"dfnID":"dom-authenticationextensionsclientinputs-prf","dfnText":"prf","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientinputs-prf"},
-"dom-authenticationextensionsclientinputs-supplementalpubkeys": {"dfnID":"dom-authenticationextensionsclientinputs-supplementalpubkeys","dfnText":"supplementalPubKeys","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientinputs-supplementalpubkeys"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dom-authenticationextensionsclientinputs-supplementalpubkeys"},
-"dom-authenticationextensionsclientinputs-uvm": {"dfnID":"dom-authenticationextensionsclientinputs-uvm","dfnText":"uvm","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientinputs-uvm"},
 "dom-authenticationextensionsclientoutputs-appid": {"dfnID":"dom-authenticationextensionsclientoutputs-appid","dfnText":"appid","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-appid"},
 "dom-authenticationextensionsclientoutputs-appidexclude": {"dfnID":"dom-authenticationextensionsclientoutputs-appidexclude","dfnText":"appidExclude","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-appidexclude"},
-"dom-authenticationextensionsclientoutputs-credprops": {"dfnID":"dom-authenticationextensionsclientoutputs-credprops","dfnText":"credProps","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-credprops"},
+"dom-authenticationextensionsclientoutputs-credprops": {"dfnID":"dom-authenticationextensionsclientoutputs-credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-credprops"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-authenticationextensionsclientoutputs-credprops"},
 "dom-authenticationextensionsclientoutputs-largeblob": {"dfnID":"dom-authenticationextensionsclientoutputs-largeblob","dfnText":"largeBlob","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-largeblob"},{"id":"ref-for-dom-authenticationextensionsclientoutputs-largeblob\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionsclientoutputs-largeblob"},
 "dom-authenticationextensionsclientoutputs-prf": {"dfnID":"dom-authenticationextensionsclientoutputs-prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsclientoutputs-prf"},
-"dom-authenticationextensionsclientoutputs-supplementalpubkeys": {"dfnID":"dom-authenticationextensionsclientoutputs-supplementalpubkeys","dfnText":"supplementalPubKeys","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#dom-authenticationextensionsclientoutputs-supplementalpubkeys"},
-"dom-authenticationextensionsclientoutputs-uvm": {"dfnID":"dom-authenticationextensionsclientoutputs-uvm","dfnText":"uvm","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-uvm"},
 "dom-authenticationextensionslargeblobinputs-read": {"dfnID":"dom-authenticationextensionslargeblobinputs-read","dfnText":"read","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2460"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2461"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2462"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargeblobinputs-read"},
 "dom-authenticationextensionslargeblobinputs-support": {"dfnID":"dom-authenticationextensionslargeblobinputs-support","dfnText":"support","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargeblobinputs-support"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-support\u2460"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-support\u2461"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-support\u2462"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargeblobinputs-support"},
 "dom-authenticationextensionslargeblobinputs-write": {"dfnID":"dom-authenticationextensionslargeblobinputs-write","dfnText":"write","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write\u2460"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write\u2461"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write\u2462"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write\u2463"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-write\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargeblobinputs-write"},
 "dom-authenticationextensionslargebloboutputs-blob": {"dfnID":"dom-authenticationextensionslargebloboutputs-blob","dfnText":"blob","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob\u2460"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-blob"},
 "dom-authenticationextensionslargebloboutputs-supported": {"dfnID":"dom-authenticationextensionslargebloboutputs-supported","dfnText":"supported","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported\u2460"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-supported"},
 "dom-authenticationextensionslargebloboutputs-written": {"dfnID":"dom-authenticationextensionslargebloboutputs-written","dfnText":"written","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-written"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-written\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-written"},
-"dom-authenticationextensionsprfinputs-eval": {"dfnID":"dom-authenticationextensionsprfinputs-eval","dfnText":"eval","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2464"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2465"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2466"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfinputs-eval"},
-"dom-authenticationextensionsprfinputs-evalbycredential": {"dfnID":"dom-authenticationextensionsprfinputs-evalbycredential","dfnText":"evalByCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
-"dom-authenticationextensionsprfoutputs-enabled": {"dfnID":"dom-authenticationextensionsprfoutputs-enabled","dfnText":"enabled","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfoutputs-enabled"},
-"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
-"dom-authenticationextensionsprfvalues-first": {"dfnID":"dom-authenticationextensionsprfvalues-first","dfnText":"first","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfvalues-first"},
-"dom-authenticationextensionsprfvalues-second": {"dfnID":"dom-authenticationextensionsprfvalues-second","dfnText":"second","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfvalues-second"},
-"dom-authenticationextensionssupplementalpubkeysinputs-attestation": {"dfnID":"dom-authenticationextensionssupplementalpubkeysinputs-attestation","dfnText":"attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"},{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation\u2460"},{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dom-authenticationextensionssupplementalpubkeysinputs-attestation"},
-"dom-authenticationextensionssupplementalpubkeysinputs-attestationformats": {"dfnID":"dom-authenticationextensionssupplementalpubkeysinputs-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"},{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats\u2460"},{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats\u2461"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"},
-"dom-authenticationextensionssupplementalpubkeysinputs-scopes": {"dfnID":"dom-authenticationextensionssupplementalpubkeysinputs-scopes","dfnText":"scopes","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"},{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes\u2460"}],"title":"10.2.2.2. Extension Definition"}],"url":"#dom-authenticationextensionssupplementalpubkeysinputs-scopes"},
-"dom-authenticationextensionssupplementalpubkeysoutputs-signatures": {"dfnID":"dom-authenticationextensionssupplementalpubkeysoutputs-signatures","dfnText":"signatures","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#dom-authenticationextensionssupplementalpubkeysoutputs-signatures"},
+"dom-authenticationextensionsprfinputs-eval": {"dfnID":"dom-authenticationextensionsprfinputs-eval","dfnText":"eval","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2464"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2465"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2466"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2468"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-eval"},
+"dom-authenticationextensionsprfinputs-evalbycredential": {"dfnID":"dom-authenticationextensionsprfinputs-evalbycredential","dfnText":"evalByCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2465"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
+"dom-authenticationextensionsprfoutputs-enabled": {"dfnID":"dom-authenticationextensionsprfoutputs-enabled","dfnText":"enabled","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2462"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#dom-authenticationextensionsprfoutputs-enabled"},
+"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2462"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2464"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2465"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2466"}],"title":"16.2.1.1. Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2467"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2468"}],"title":"16.2.1.2. CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
+"dom-authenticationextensionsprfvalues-first": {"dfnID":"dom-authenticationextensionsprfvalues-first","dfnText":"first","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2462"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2463"}],"title":"16.2.1.1. Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2465"}],"title":"16.2.1.2. CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-first"},
+"dom-authenticationextensionsprfvalues-second": {"dfnID":"dom-authenticationextensionsprfvalues-second","dfnText":"second","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2463"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2465"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2466"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2467"}],"title":"16.2.1.1. Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2468"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460\u24ea"}],"title":"16.2.1.2. CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-second"},
 "dom-authenticationresponsejson-authenticatorattachment": {"dfnID":"dom-authenticationresponsejson-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-authenticatorattachment"},
 "dom-authenticationresponsejson-clientextensionresults": {"dfnID":"dom-authenticationresponsejson-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationresponsejson-clientextensionresults"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-authenticationresponsejson-clientextensionresults"},
 "dom-authenticationresponsejson-id": {"dfnID":"dom-authenticationresponsejson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-id"},
 "dom-authenticationresponsejson-rawid": {"dfnID":"dom-authenticationresponsejson-rawid","dfnText":"rawId","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-rawid"},
 "dom-authenticationresponsejson-response": {"dfnID":"dom-authenticationresponsejson-response","dfnText":"response","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-response"},
 "dom-authenticationresponsejson-type": {"dfnID":"dom-authenticationresponsejson-type","dfnText":"type","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-type"},
-"dom-authenticatorassertionresponse-authenticatordata": {"dfnID":"dom-authenticatorassertionresponse-authenticatordata","dfnText":"authenticatorData","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorassertionresponse-authenticatordata"},
-"dom-authenticatorassertionresponse-signature": {"dfnID":"dom-authenticatorassertionresponse-signature","dfnText":"signature","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorassertionresponse-signature"},
-"dom-authenticatorassertionresponse-userhandle": {"dfnID":"dom-authenticatorassertionresponse-userhandle","dfnText":"userHandle","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2465"},{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2466"},{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorassertionresponse-userhandle"},
+"dom-authenticatorassertionresponse-authenticatordata": {"dfnID":"dom-authenticatorassertionresponse-authenticatordata","dfnText":"authenticatorData","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2462"},{"id":"ref-for-dom-authenticatorassertionresponse-authenticatordata\u2463"}],"title":"16. Test Vectors"}],"url":"#dom-authenticatorassertionresponse-authenticatordata"},
+"dom-authenticatorassertionresponse-signature": {"dfnID":"dom-authenticatorassertionresponse-signature","dfnText":"signature","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2462"},{"id":"ref-for-dom-authenticatorassertionresponse-signature\u2463"}],"title":"16. Test Vectors"}],"url":"#dom-authenticatorassertionresponse-signature"},
+"dom-authenticatorassertionresponse-userhandle": {"dfnID":"dom-authenticatorassertionresponse-userhandle","dfnText":"userHandle","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2465"},{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2466"},{"id":"ref-for-dom-authenticatorassertionresponse-userhandle\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorassertionresponse-userhandle"},
 "dom-authenticatorassertionresponsejson-authenticatordata": {"dfnID":"dom-authenticatorassertionresponsejson-authenticatordata","dfnText":"authenticatorData","external":false,"refSections":[],"url":"#dom-authenticatorassertionresponsejson-authenticatordata"},
 "dom-authenticatorassertionresponsejson-clientdatajson": {"dfnID":"dom-authenticatorassertionresponsejson-clientdatajson","dfnText":"clientDataJSON","external":false,"refSections":[],"url":"#dom-authenticatorassertionresponsejson-clientdatajson"},
 "dom-authenticatorassertionresponsejson-signature": {"dfnID":"dom-authenticatorassertionresponsejson-signature","dfnText":"signature","external":false,"refSections":[],"url":"#dom-authenticatorassertionresponsejson-signature"},
 "dom-authenticatorassertionresponsejson-userhandle": {"dfnID":"dom-authenticatorassertionresponsejson-userhandle","dfnText":"userHandle","external":false,"refSections":[],"url":"#dom-authenticatorassertionresponsejson-userhandle"},
-"dom-authenticatorattachment-cross-platform": {"dfnID":"dom-authenticatorattachment-cross-platform","dfnText":"cross-platform","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattachment-cross-platform"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-authenticatorattachment-cross-platform\u2460"},{"id":"ref-for-dom-authenticatorattachment-cross-platform\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-authenticatorattachment-cross-platform"},
-"dom-authenticatorattachment-platform": {"dfnID":"dom-authenticatorattachment-platform","dfnText":"platform","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattachment-platform"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-authenticatorattachment-platform\u2460"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-authenticatorattachment-platform"},
-"dom-authenticatorattestationresponse-attestationobject": {"dfnID":"dom-authenticatorattestationresponse-attestationobject","dfnText":"attestationObject","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2461"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2463"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2464"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2465"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2466"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2467"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-authenticatorattestationresponse-attestationobject"},
+"dom-authenticatorattachment-cross-platform": {"dfnID":"dom-authenticatorattachment-cross-platform","dfnText":"cross-platform","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattachment-cross-platform"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-authenticatorattachment-cross-platform\u2460"},{"id":"ref-for-dom-authenticatorattachment-cross-platform\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-authenticatorattachment-cross-platform"},
+"dom-authenticatorattachment-platform": {"dfnID":"dom-authenticatorattachment-platform","dfnText":"platform","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattachment-platform"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-authenticatorattachment-platform\u2460"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-authenticatorattachment-platform"},
+"dom-authenticatorattestationresponse-attestationobject": {"dfnID":"dom-authenticatorattestationresponse-attestationobject","dfnText":"attestationObject","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2461"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2463"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2464"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2465"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2466"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2468"},{"id":"ref-for-dom-authenticatorattestationresponse-attestationobject\u2460\u24ea"}],"title":"16. Test Vectors"}],"url":"#dom-authenticatorattestationresponse-attestationobject"},
 "dom-authenticatorattestationresponse-getauthenticatordata": {"dfnID":"dom-authenticatorattestationresponse-getauthenticatordata","dfnText":"getAuthenticatorData","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata\u2460"},{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata\u2461"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getauthenticatordata"},
 "dom-authenticatorattestationresponse-getpublickey": {"dfnID":"dom-authenticatorattestationresponse-getpublickey","dfnText":"getPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2461"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2462"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2463"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2464"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2465"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getpublickey"},
 "dom-authenticatorattestationresponse-getpublickeyalgorithm": {"dfnID":"dom-authenticatorattestationresponse-getpublickeyalgorithm","dfnText":"getPublicKeyAlgorithm","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm\u2461"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getpublickeyalgorithm"},
 "dom-authenticatorattestationresponse-gettransports": {"dfnID":"dom-authenticatorattestationresponse-gettransports","dfnText":"getTransports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports"},{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2464"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-authenticatorattestationresponse-gettransports"},
-"dom-authenticatorattestationresponse-transports-slot": {"dfnID":"dom-authenticatorattestationresponse-transports-slot","dfnText":"[[transports]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}],"url":"#dom-authenticatorattestationresponse-transports-slot"},
+"dom-authenticatorattestationresponse-transports-slot": {"dfnID":"dom-authenticatorattestationresponse-transports-slot","dfnText":"[[transports]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}],"url":"#dom-authenticatorattestationresponse-transports-slot"},
 "dom-authenticatorattestationresponsejson-attestationobject": {"dfnID":"dom-authenticatorattestationresponsejson-attestationobject","dfnText":"attestationObject","external":false,"refSections":[],"url":"#dom-authenticatorattestationresponsejson-attestationobject"},
 "dom-authenticatorattestationresponsejson-authenticatordata": {"dfnID":"dom-authenticatorattestationresponsejson-authenticatordata","dfnText":"authenticatorData","external":false,"refSections":[],"url":"#dom-authenticatorattestationresponsejson-authenticatordata"},
 "dom-authenticatorattestationresponsejson-clientdatajson": {"dfnID":"dom-authenticatorattestationresponsejson-clientdatajson","dfnText":"clientDataJSON","external":false,"refSections":[],"url":"#dom-authenticatorattestationresponsejson-clientdatajson"},
 "dom-authenticatorattestationresponsejson-publickey": {"dfnID":"dom-authenticatorattestationresponsejson-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponsejson-publickey"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-authenticatorattestationresponsejson-publickey"},
 "dom-authenticatorattestationresponsejson-publickeyalgorithm": {"dfnID":"dom-authenticatorattestationresponsejson-publickeyalgorithm","dfnText":"publicKeyAlgorithm","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponsejson-publickeyalgorithm"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-authenticatorattestationresponsejson-publickeyalgorithm"},
 "dom-authenticatorattestationresponsejson-transports": {"dfnID":"dom-authenticatorattestationresponsejson-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponsejson-transports"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-authenticatorattestationresponsejson-transports"},
-"dom-authenticatorresponse-clientdatajson": {"dfnID":"dom-authenticatorresponse-clientdatajson","dfnText":"clientDataJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2465"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2466"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2467"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorresponse-clientdatajson"},
-"dom-authenticatorselectioncriteria-authenticatorattachment": {"dfnID":"dom-authenticatorselectioncriteria-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2463"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2464"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-authenticatorselectioncriteria-authenticatorattachment"},
-"dom-authenticatorselectioncriteria-requireresidentkey": {"dfnID":"dom-authenticatorselectioncriteria-requireresidentkey","dfnText":"requireResidentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2463"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#dom-authenticatorselectioncriteria-requireresidentkey"},
-"dom-authenticatorselectioncriteria-residentkey": {"dfnID":"dom-authenticatorselectioncriteria-residentkey","dfnText":"residentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticatorselectioncriteria-residentkey"},
-"dom-authenticatorselectioncriteria-userverification": {"dfnID":"dom-authenticatorselectioncriteria-userverification","dfnText":"userVerification","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-authenticatorselectioncriteria-userverification"},
+"dom-authenticatorresponse-clientdatajson": {"dfnID":"dom-authenticatorresponse-clientdatajson","dfnText":"clientDataJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2465"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2466"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2467"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u2460"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u2461"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u2462"}],"title":"16. Test Vectors"}],"url":"#dom-authenticatorresponse-clientdatajson"},
+"dom-authenticatorselectioncriteria-authenticatorattachment": {"dfnID":"dom-authenticatorselectioncriteria-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2463"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2464"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-authenticatorselectioncriteria-authenticatorattachment"},
+"dom-authenticatorselectioncriteria-requireresidentkey": {"dfnID":"dom-authenticatorselectioncriteria-requireresidentkey","dfnText":"requireResidentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2463"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#dom-authenticatorselectioncriteria-requireresidentkey"},
+"dom-authenticatorselectioncriteria-residentkey": {"dfnID":"dom-authenticatorselectioncriteria-residentkey","dfnText":"residentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticatorselectioncriteria-residentkey"},
+"dom-authenticatorselectioncriteria-userverification": {"dfnID":"dom-authenticatorselectioncriteria-userverification","dfnText":"userVerification","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-authenticatorselectioncriteria-userverification"},
 "dom-authenticatortransport-ble": {"dfnID":"dom-authenticatortransport-ble","dfnText":"ble","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-ble"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}],"url":"#dom-authenticatortransport-ble"},
 "dom-authenticatortransport-hybrid": {"dfnID":"dom-authenticatortransport-hybrid","dfnText":"hybrid","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2461"},{"id":"ref-for-dom-authenticatortransport-hybrid\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2463"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#dom-authenticatortransport-hybrid"},
-"dom-authenticatortransport-internal": {"dfnID":"dom-authenticatortransport-internal","dfnText":"internal","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-internal"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#dom-authenticatortransport-internal"},
+"dom-authenticatortransport-internal": {"dfnID":"dom-authenticatortransport-internal","dfnText":"internal","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-internal"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#dom-authenticatortransport-internal"},
 "dom-authenticatortransport-nfc": {"dfnID":"dom-authenticatortransport-nfc","dfnText":"nfc","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-nfc"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}],"url":"#dom-authenticatortransport-nfc"},
 "dom-authenticatortransport-smart-card": {"dfnID":"dom-authenticatortransport-smart-card","dfnText":"smart-card","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-smart-card"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}],"url":"#dom-authenticatortransport-smart-card"},
 "dom-authenticatortransport-usb": {"dfnID":"dom-authenticatortransport-usb","dfnText":"usb","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-usb"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}],"url":"#dom-authenticatortransport-usb"},
-"dom-clientcapability-conditionalcreate": {"dfnID":"dom-clientcapability-conditionalcreate","dfnText":"conditionalCreate","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-conditionalcreate"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-clientcapability-conditionalcreate\u2460"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-conditionalcreate"},
-"dom-clientcapability-conditionalmediation": {"dfnID":"dom-clientcapability-conditionalmediation","dfnText":"conditionalMediation","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-conditionalmediation"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-conditionalmediation"},
+"dom-clientcapability-conditionalcreate": {"dfnID":"dom-clientcapability-conditionalcreate","dfnText":"conditionalCreate","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-conditionalcreate"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-clientcapability-conditionalcreate\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-clientcapability-conditionalcreate\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-conditionalcreate"},
+"dom-clientcapability-conditionalget": {"dfnID":"dom-clientcapability-conditionalget","dfnText":"conditionalGet","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-conditionalget"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-clientcapability-conditionalget\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-clientcapability-conditionalget\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-conditionalget"},
 "dom-clientcapability-hybridtransport": {"dfnID":"dom-clientcapability-hybridtransport","dfnText":"hybridTransport","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-hybridtransport"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-hybridtransport"},
 "dom-clientcapability-passkeyplatformauthenticator": {"dfnID":"dom-clientcapability-passkeyplatformauthenticator","dfnText":"passkeyPlatformAuthenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-passkeyplatformauthenticator"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-passkeyplatformauthenticator"},
+"dom-clientcapability-relatedorigins": {"dfnID":"dom-clientcapability-relatedorigins","dfnText":"relatedOrigins","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-relatedorigins"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-clientcapability-relatedorigins\u2460"}],"title":"5.11. Using Web Authentication across related origins"}],"url":"#dom-clientcapability-relatedorigins"},
+"dom-clientcapability-signalallacceptedcredentials": {"dfnID":"dom-clientcapability-signalallacceptedcredentials","dfnText":"signalAllAcceptedCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-signalallacceptedcredentials"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-signalallacceptedcredentials"},
+"dom-clientcapability-signalcurrentuserdetails": {"dfnID":"dom-clientcapability-signalcurrentuserdetails","dfnText":"signalCurrentUserDetails","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-signalcurrentuserdetails"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-signalcurrentuserdetails"},
+"dom-clientcapability-signalunknowncredential": {"dfnID":"dom-clientcapability-signalunknowncredential","dfnText":"signalUnknownCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-signalunknowncredential"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-signalunknowncredential"},
 "dom-clientcapability-userverifyingplatformauthenticator": {"dfnID":"dom-clientcapability-userverifyingplatformauthenticator","dfnText":"userVerifyingPlatformAuthenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-clientcapability-userverifyingplatformauthenticator"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-clientcapability-userverifyingplatformauthenticator"},
-"dom-collectedclientdata-challenge": {"dfnID":"dom-collectedclientdata-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2462"},{"id":"ref-for-dom-collectedclientdata-challenge\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2464"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2467"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dom-collectedclientdata-challenge"},
-"dom-collectedclientdata-crossorigin": {"dfnID":"dom-collectedclientdata-crossorigin","dfnText":"crossOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2461"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2463"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2465"}],"title":"5.8.1.3. Future development"}],"url":"#dom-collectedclientdata-crossorigin"},
-"dom-collectedclientdata-origin": {"dfnID":"dom-collectedclientdata-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-origin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u24ea"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2460"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2461"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2467"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2461\u24ea"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-origin"},
+"dom-collectedclientdata-challenge": {"dfnID":"dom-collectedclientdata-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2462"},{"id":"ref-for-dom-collectedclientdata-challenge\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2464"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-challenge\u2467"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dom-collectedclientdata-challenge"},
+"dom-collectedclientdata-crossorigin": {"dfnID":"dom-collectedclientdata-crossorigin","dfnText":"crossOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2461"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2463"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-collectedclientdata-crossorigin"},
+"dom-collectedclientdata-origin": {"dfnID":"dom-collectedclientdata-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-origin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u24ea"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2460"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2461"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2467"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2461\u24ea"},{"id":"ref-for-dom-collectedclientdata-origin\u2461\u2460"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2461\u2461"}],"title":"16. Test Vectors"}],"url":"#dom-collectedclientdata-origin"},
 "dom-collectedclientdata-tokenbinding": {"dfnID":"dom-collectedclientdata-tokenbinding","dfnText":"tokenBinding","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-tokenbinding"},{"id":"ref-for-dom-collectedclientdata-tokenbinding\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-collectedclientdata-tokenbinding"},
-"dom-collectedclientdata-toporigin": {"dfnID":"dom-collectedclientdata-toporigin","dfnText":"topOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2466"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2468"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2460"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2461"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2465"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-toporigin"},
-"dom-collectedclientdata-type": {"dfnID":"dom-collectedclientdata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-type"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2462"},{"id":"ref-for-dom-collectedclientdata-type\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-collectedclientdata-type"},
-"dom-credentialcreationoptions-publickey": {"dfnID":"dom-credentialcreationoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2460"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2461"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2463"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-credentialcreationoptions-publickey"},
-"dom-credentialpropertiesoutput-authenticatordisplayname": {"dfnID":"dom-credentialpropertiesoutput-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2460"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2461"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2462"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2463"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-credentialpropertiesoutput-authenticatordisplayname"},
+"dom-collectedclientdata-toporigin": {"dfnID":"dom-collectedclientdata-toporigin","dfnText":"topOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2467"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2468"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2460"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2467"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2468"}],"title":"16. Test Vectors"}],"url":"#dom-collectedclientdata-toporigin"},
+"dom-collectedclientdata-type": {"dfnID":"dom-collectedclientdata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-type"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2462"},{"id":"ref-for-dom-collectedclientdata-type\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-collectedclientdata-type"},
+"dom-credentialcreationoptions-publickey": {"dfnID":"dom-credentialcreationoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2460"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2461"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2463"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-credentialcreationoptions-publickey"},
 "dom-credentialpropertiesoutput-rk": {"dfnID":"dom-credentialpropertiesoutput-rk","dfnText":"rk","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-rk"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2460"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2461"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2462"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2463"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2464"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2465"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2466"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-credentialpropertiesoutput-rk"},
-"dom-credentialrequestoptions-publickey": {"dfnID":"dom-credentialrequestoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2460"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2461"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-credentialrequestoptions-publickey"},
+"dom-credentialrequestoptions-publickey": {"dfnID":"dom-credentialrequestoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2460"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2461"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-credentialrequestoptions-publickey"},
+"dom-currentuserdetailsoptions-displayname": {"dfnID":"dom-currentuserdetailsoptions-displayname","dfnText":"displayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-currentuserdetailsoptions-displayname"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dom-currentuserdetailsoptions-displayname"},
+"dom-currentuserdetailsoptions-name": {"dfnID":"dom-currentuserdetailsoptions-name","dfnText":"name","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-currentuserdetailsoptions-name"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dom-currentuserdetailsoptions-name"},
+"dom-currentuserdetailsoptions-rpid": {"dfnID":"dom-currentuserdetailsoptions-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-currentuserdetailsoptions-rpid"},{"id":"ref-for-dom-currentuserdetailsoptions-rpid\u2460"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dom-currentuserdetailsoptions-rpid"},
+"dom-currentuserdetailsoptions-userid": {"dfnID":"dom-currentuserdetailsoptions-userid","dfnText":"userId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-currentuserdetailsoptions-userid"},{"id":"ref-for-dom-currentuserdetailsoptions-userid\u2460"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dom-currentuserdetailsoptions-userid"},
 "dom-issuing-a-credential-request-to-an-authenticator-authenticator": {"dfnID":"dom-issuing-a-credential-request-to-an-authenticator-authenticator","dfnText":"authenticator","external":false,"refSections":[],"url":"#dom-issuing-a-credential-request-to-an-authenticator-authenticator"},
 "dom-issuing-a-credential-request-to-an-authenticator-authenticatorextensions": {"dfnID":"dom-issuing-a-credential-request-to-an-authenticator-authenticatorextensions","dfnText":"authenticatorExtensions","external":false,"refSections":[],"url":"#dom-issuing-a-credential-request-to-an-authenticator-authenticatorextensions"},
 "dom-issuing-a-credential-request-to-an-authenticator-clientdatahash": {"dfnID":"dom-issuing-a-credential-request-to-an-authenticator-clientdatahash","dfnText":"clientDataHash","external":false,"refSections":[],"url":"#dom-issuing-a-credential-request-to-an-authenticator-clientdatahash"},
@@ -11571,45 +12271,50 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids": {"dfnID":"dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids","dfnText":"savedCredentialIds","external":false,"refSections":[],"url":"#dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"},
 "dom-largeblobsupport-preferred": {"dfnID":"dom-largeblobsupport-preferred","dfnText":"\"preferred\"","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-largeblobsupport-preferred"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-largeblobsupport-preferred"},
 "dom-largeblobsupport-required": {"dfnID":"dom-largeblobsupport-required","dfnText":"\"required\"","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-largeblobsupport-required"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-largeblobsupport-required"},
-"dom-publickeycredential-authenticatorattachment": {"dfnID":"dom-publickeycredential-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment"},{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}],"url":"#dom-publickeycredential-authenticatorattachment"},
-"dom-publickeycredential-clientextensionsresults-slot": {"dfnID":"dom-publickeycredential-clientextensionsresults-slot","dfnText":"[[clientExtensionsResults]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-clientextensionsresults-slot"},
-"dom-publickeycredential-collectfromcredentialstore-slot": {"dfnID":"dom-publickeycredential-collectfromcredentialstore-slot","dfnText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-collectfromcredentialstore-slot"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}],"url":"#dom-publickeycredential-collectfromcredentialstore-slot"},
+"dom-publickeycredential-authenticatorattachment": {"dfnID":"dom-publickeycredential-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment"},{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-authenticatorattachment\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}],"url":"#dom-publickeycredential-authenticatorattachment"},
+"dom-publickeycredential-clientextensionsresults-slot": {"dfnID":"dom-publickeycredential-clientextensionsresults-slot","dfnText":"[[clientExtensionsResults]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-clientextensionsresults-slot\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-clientextensionsresults-slot"},
 "dom-publickeycredential-create-origin-options-sameoriginwithancestors-options": {"dfnID":"dom-publickeycredential-create-origin-options-sameoriginwithancestors-options","dfnText":"options","external":false,"refSections":[],"url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-options"},
-"dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin": {"dfnID":"dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"},
-"dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
-"dom-publickeycredential-create-slot": {"dfnID":"dom-publickeycredential-create-slot","dfnText":"[[Create]](origin,\noptions, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2461"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2462"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2463"},{"id":"ref-for-dom-publickeycredential-create-slot\u2464"},{"id":"ref-for-dom-publickeycredential-create-slot\u2465"},{"id":"ref-for-dom-publickeycredential-create-slot\u2466"},{"id":"ref-for-dom-publickeycredential-create-slot\u2467"}],"title":"5.6. Abort Operations with AbortSignal"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2468"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u24ea"},{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredential-create-slot"},
+"dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin": {"dfnID":"dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"},
+"dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},{"id":"ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
+"dom-publickeycredential-create-slot": {"dfnID":"dom-publickeycredential-create-slot","dfnText":"[[Create]](origin, options, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2461"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2462"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2463"},{"id":"ref-for-dom-publickeycredential-create-slot\u2464"},{"id":"ref-for-dom-publickeycredential-create-slot\u2465"},{"id":"ref-for-dom-publickeycredential-create-slot\u2466"},{"id":"ref-for-dom-publickeycredential-create-slot\u2467"}],"title":"5.6. Abort Operations with AbortSignal"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2468"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u24ea"},{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredential-create-slot\u2460\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredential-create-slot"},
 "dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options","dfnText":"options","external":false,"refSections":[],"url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-options"},
-"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"},
-"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
-"dom-publickeycredential-discoverfromexternalsource-slot": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-slot","dfnText":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2462"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2463"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2464"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2465"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2466"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2467"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2468"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u24ea"}],"title":"5.6. Abort Operations with AbortSignal"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2460"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2461"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2462"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#dom-publickeycredential-discoverfromexternalsource-slot"},
+"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"},
+"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
+"dom-publickeycredential-discoverfromexternalsource-slot": {"dfnID":"dom-publickeycredential-discoverfromexternalsource-slot","dfnText":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2461"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2462"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2463"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2466"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2467"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2468"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u24ea"},{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2460"}],"title":"5.6. Abort Operations with AbortSignal"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2461"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#dom-publickeycredential-discoverfromexternalsource-slot"},
 "dom-publickeycredential-discovery-slot": {"dfnID":"dom-publickeycredential-discovery-slot","dfnText":"[[discovery]]","external":false,"refSections":[],"url":"#dom-publickeycredential-discovery-slot"},
-"dom-publickeycredential-getclientcapabilities": {"dfnID":"dom-publickeycredential-getclientcapabilities","dfnText":"getClientCapabilities","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities\u2460"}],"title":"14.5.4. Disclosing Client Capabilities"}],"url":"#dom-publickeycredential-getclientcapabilities"},
+"dom-publickeycredential-getclientcapabilities": {"dfnID":"dom-publickeycredential-getclientcapabilities","dfnText":"getClientCapabilities","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientcapabilities\u2463"}],"title":"14.5.4. Disclosing Client Capabilities"}],"url":"#dom-publickeycredential-getclientcapabilities"},
 "dom-publickeycredential-getclientextensionresults": {"dfnID":"dom-publickeycredential-getclientextensionresults","dfnText":"getClientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-getclientextensionresults"},{"id":"ref-for-dom-publickeycredential-getclientextensionresults\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientextensionresults\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientextensionresults\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredential-getclientextensionresults\u2463"}],"title":"9.4. Client Extension Processing"}],"url":"#dom-publickeycredential-getclientextensionresults"},
-"dom-publickeycredential-identifier-slot": {"dfnID":"dom-publickeycredential-identifier-slot","dfnText":"[[identifier]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot"},{"id":"ref-for-dom-publickeycredential-identifier-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#dom-publickeycredential-identifier-slot"},
-"dom-publickeycredential-isconditionalmediationavailable": {"dfnID":"dom-publickeycredential-isconditionalmediationavailable","dfnText":"isConditionalMediationAvailable","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-isconditionalmediationavailable"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-isconditionalmediationavailable\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}],"url":"#dom-publickeycredential-isconditionalmediationavailable"},
-"dom-publickeycredential-isuserverifyingplatformauthenticatoravailable": {"dfnID":"dom-publickeycredential-isuserverifyingplatformauthenticatoravailable","dfnText":"isUserVerifyingPlatformAuthenticatorAvailable","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"},
+"dom-publickeycredential-identifier-slot": {"dfnID":"dom-publickeycredential-identifier-slot","dfnText":"[[identifier]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot"},{"id":"ref-for-dom-publickeycredential-identifier-slot\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-identifier-slot\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#dom-publickeycredential-identifier-slot"},
+"dom-publickeycredential-isconditionalmediationavailable": {"dfnID":"dom-publickeycredential-isconditionalmediationavailable","dfnText":"isConditionalMediationAvailable","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-isconditionalmediationavailable"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-isconditionalmediationavailable\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredential-isconditionalmediationavailable\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-publickeycredential-isconditionalmediationavailable"},
+"dom-publickeycredential-isuserverifyingplatformauthenticatoravailable": {"dfnID":"dom-publickeycredential-isuserverifyingplatformauthenticatoravailable","dfnText":"isUserVerifyingPlatformAuthenticatorAvailable","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"},
 "dom-publickeycredential-parsecreationoptionsfromjson": {"dfnID":"dom-publickeycredential-parsecreationoptionsfromjson","dfnText":"parseCreationOptionsFromJSON","external":false,"refSections":[],"url":"#dom-publickeycredential-parsecreationoptionsfromjson"},
 "dom-publickeycredential-parsecreationoptionsfromjson-options-options": {"dfnID":"dom-publickeycredential-parsecreationoptionsfromjson-options-options","dfnText":"options","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}],"url":"#dom-publickeycredential-parsecreationoptionsfromjson-options-options"},
 "dom-publickeycredential-parserequestoptionsfromjson": {"dfnID":"dom-publickeycredential-parserequestoptionsfromjson","dfnText":"parseRequestOptionsFromJSON","external":false,"refSections":[],"url":"#dom-publickeycredential-parserequestoptionsfromjson"},
 "dom-publickeycredential-parserequestoptionsfromjson-options-options": {"dfnID":"dom-publickeycredential-parserequestoptionsfromjson-options-options","dfnText":"options","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#dom-publickeycredential-parserequestoptionsfromjson-options-options"},
 "dom-publickeycredential-rawid": {"dfnID":"dom-publickeycredential-rawid","dfnText":"rawId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-rawid"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-rawid\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredential-rawid\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredential-rawid\u2462"},{"id":"ref-for-dom-publickeycredential-rawid\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredential-rawid\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-publickeycredential-rawid"},
-"dom-publickeycredential-response": {"dfnID":"dom-publickeycredential-response","dfnText":"response","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-response"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-publickeycredential-response"},
+"dom-publickeycredential-response": {"dfnID":"dom-publickeycredential-response","dfnText":"response","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-response"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredential-response\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-publickeycredential-response"},
+"dom-publickeycredential-signalallacceptedcredentials": {"dfnID":"dom-publickeycredential-signalallacceptedcredentials","dfnText":"signalAllAcceptedCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2460"},{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2461"},{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2462"},{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2463"},{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2464"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2465"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalallacceptedcredentials\u2466"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#dom-publickeycredential-signalallacceptedcredentials"},
+"dom-publickeycredential-signalallacceptedcredentials-options-options": {"dfnID":"dom-publickeycredential-signalallacceptedcredentials-options-options","dfnText":"options","external":false,"refSections":[],"url":"#dom-publickeycredential-signalallacceptedcredentials-options-options"},
+"dom-publickeycredential-signalcurrentuserdetails": {"dfnID":"dom-publickeycredential-signalcurrentuserdetails","dfnText":"signalCurrentUserDetails","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails"},{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails\u2460"},{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails\u2461"},{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails\u2462"},{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalcurrentuserdetails\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#dom-publickeycredential-signalcurrentuserdetails"},
+"dom-publickeycredential-signalcurrentuserdetails-options-options": {"dfnID":"dom-publickeycredential-signalcurrentuserdetails-options-options","dfnText":"options","external":false,"refSections":[],"url":"#dom-publickeycredential-signalcurrentuserdetails-options-options"},
+"dom-publickeycredential-signalunknowncredential": {"dfnID":"dom-publickeycredential-signalunknowncredential","dfnText":"signalUnknownCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-signalunknowncredential"},{"id":"ref-for-dom-publickeycredential-signalunknowncredential\u2460"},{"id":"ref-for-dom-publickeycredential-signalunknowncredential\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalunknowncredential\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalunknowncredential\u2463"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-publickeycredential-signalunknowncredential\u2464"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#dom-publickeycredential-signalunknowncredential"},
+"dom-publickeycredential-signalunknowncredential-options-options": {"dfnID":"dom-publickeycredential-signalunknowncredential-options-options","dfnText":"options","external":false,"refSections":[],"url":"#dom-publickeycredential-signalunknowncredential-options-options"},
 "dom-publickeycredential-store-credential-sameoriginwithancestors-credential": {"dfnID":"dom-publickeycredential-store-credential-sameoriginwithancestors-credential","dfnText":"credential","external":false,"refSections":[],"url":"#dom-publickeycredential-store-credential-sameoriginwithancestors-credential"},
 "dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[],"url":"#dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors"},
 "dom-publickeycredential-store-slot": {"dfnID":"dom-publickeycredential-store-slot","dfnText":"[[Store]](credential, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-store-slot"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-publickeycredential-store-slot"},
-"dom-publickeycredential-tojson": {"dfnID":"dom-publickeycredential-tojson","dfnText":"toJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-tojson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-publickeycredential-tojson"},
+"dom-publickeycredential-tojson": {"dfnID":"dom-publickeycredential-tojson","dfnText":"toJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-tojson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-tojson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredential-tojson"},
 "dom-publickeycredential-type-slot": {"dfnID":"dom-publickeycredential-type-slot","dfnText":"[[type]]","external":false,"refSections":[],"url":"#dom-publickeycredential-type-slot"},
-"dom-publickeycredentialcreationoptions-attestation": {"dfnID":"dom-publickeycredentialcreationoptions-attestation","dfnText":"attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2463"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestation"},
-"dom-publickeycredentialcreationoptions-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptions-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2461"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestationformats"},
-"dom-publickeycredentialcreationoptions-authenticatorselection": {"dfnID":"dom-publickeycredentialcreationoptions-authenticatorselection","dfnText":"authenticatorSelection","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2468"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-publickeycredentialcreationoptions-authenticatorselection"},
-"dom-publickeycredentialcreationoptions-challenge": {"dfnID":"dom-publickeycredentialcreationoptions-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2462"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2463"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dom-publickeycredentialcreationoptions-challenge"},
-"dom-publickeycredentialcreationoptions-excludecredentials": {"dfnID":"dom-publickeycredentialcreationoptions-excludecredentials","dfnText":"excludeCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
-"dom-publickeycredentialcreationoptions-extensions": {"dfnID":"dom-publickeycredentialcreationoptions-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2466"}],"title":"9.3. Extending Request Parameters"}],"url":"#dom-publickeycredentialcreationoptions-extensions"},
-"dom-publickeycredentialcreationoptions-hints": {"dfnID":"dom-publickeycredentialcreationoptions-hints","dfnText":"hints","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-hints"},
-"dom-publickeycredentialcreationoptions-pubkeycredparams": {"dfnID":"dom-publickeycredentialcreationoptions-pubkeycredparams","dfnText":"pubKeyCredParams","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2461"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2463"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
-"dom-publickeycredentialcreationoptions-rp": {"dfnID":"dom-publickeycredentialcreationoptions-rp","dfnText":"rp","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2467"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-rp"},
-"dom-publickeycredentialcreationoptions-timeout": {"dfnID":"dom-publickeycredentialcreationoptions-timeout","dfnText":"timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#dom-publickeycredentialcreationoptions-timeout"},
-"dom-publickeycredentialcreationoptions-user": {"dfnID":"dom-publickeycredentialcreationoptions-user","dfnText":"user","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"}],"url":"#dom-publickeycredentialcreationoptions-user"},
+"dom-publickeycredentialcreationoptions-attestation": {"dfnID":"dom-publickeycredentialcreationoptions-attestation","dfnText":"attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2463"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestation"},
+"dom-publickeycredentialcreationoptions-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptions-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2461"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestationformats"},
+"dom-publickeycredentialcreationoptions-authenticatorselection": {"dfnID":"dom-publickeycredentialcreationoptions-authenticatorselection","dfnText":"authenticatorSelection","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2468"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-publickeycredentialcreationoptions-authenticatorselection"},
+"dom-publickeycredentialcreationoptions-challenge": {"dfnID":"dom-publickeycredentialcreationoptions-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2462"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2464"}],"title":"16. Test Vectors"}],"url":"#dom-publickeycredentialcreationoptions-challenge"},
+"dom-publickeycredentialcreationoptions-excludecredentials": {"dfnID":"dom-publickeycredentialcreationoptions-excludecredentials","dfnText":"excludeCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2464"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
+"dom-publickeycredentialcreationoptions-extensions": {"dfnID":"dom-publickeycredentialcreationoptions-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2464"}],"title":"9.3. Extending Request Parameters"}],"url":"#dom-publickeycredentialcreationoptions-extensions"},
+"dom-publickeycredentialcreationoptions-hints": {"dfnID":"dom-publickeycredentialcreationoptions-hints","dfnText":"hints","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-hints"},
+"dom-publickeycredentialcreationoptions-pubkeycredparams": {"dfnID":"dom-publickeycredentialcreationoptions-pubkeycredparams","dfnText":"pubKeyCredParams","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2463"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
+"dom-publickeycredentialcreationoptions-rp": {"dfnID":"dom-publickeycredentialcreationoptions-rp","dfnText":"rp","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2466"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-rp"},
+"dom-publickeycredentialcreationoptions-timeout": {"dfnID":"dom-publickeycredentialcreationoptions-timeout","dfnText":"timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#dom-publickeycredentialcreationoptions-timeout"},
+"dom-publickeycredentialcreationoptions-user": {"dfnID":"dom-publickeycredentialcreationoptions-user","dfnText":"user","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"}],"url":"#dom-publickeycredentialcreationoptions-user"},
 "dom-publickeycredentialcreationoptionsjson-attestation": {"dfnID":"dom-publickeycredentialcreationoptionsjson-attestation","dfnText":"attestation","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-attestation"},
 "dom-publickeycredentialcreationoptionsjson-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptionsjson-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-attestationformats"},
 "dom-publickeycredentialcreationoptionsjson-authenticatorselection": {"dfnID":"dom-publickeycredentialcreationoptionsjson-authenticatorselection","dfnText":"authenticatorSelection","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-authenticatorselection"},
@@ -11621,24 +12326,24 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialcreationoptionsjson-rp": {"dfnID":"dom-publickeycredentialcreationoptionsjson-rp","dfnText":"rp","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-rp"},
 "dom-publickeycredentialcreationoptionsjson-timeout": {"dfnID":"dom-publickeycredentialcreationoptionsjson-timeout","dfnText":"timeout","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-timeout"},
 "dom-publickeycredentialcreationoptionsjson-user": {"dfnID":"dom-publickeycredentialcreationoptionsjson-user","dfnText":"user","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-user"},
-"dom-publickeycredentialdescriptor-id": {"dfnID":"dom-publickeycredentialdescriptor-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2467"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredentialdescriptor-id"},
-"dom-publickeycredentialdescriptor-transports": {"dfnID":"dom-publickeycredentialdescriptor-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2464"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialdescriptor-transports"},
-"dom-publickeycredentialdescriptor-type": {"dfnID":"dom-publickeycredentialdescriptor-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialdescriptor-type"},
+"dom-publickeycredentialdescriptor-id": {"dfnID":"dom-publickeycredentialdescriptor-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2467"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredentialdescriptor-id"},
+"dom-publickeycredentialdescriptor-transports": {"dfnID":"dom-publickeycredentialdescriptor-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2464"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-publickeycredentialdescriptor-transports"},
+"dom-publickeycredentialdescriptor-type": {"dfnID":"dom-publickeycredentialdescriptor-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialdescriptor-type"},
 "dom-publickeycredentialdescriptorjson-id": {"dfnID":"dom-publickeycredentialdescriptorjson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-id"},
 "dom-publickeycredentialdescriptorjson-transports": {"dfnID":"dom-publickeycredentialdescriptorjson-transports","dfnText":"transports","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-transports"},
 "dom-publickeycredentialdescriptorjson-type": {"dfnID":"dom-publickeycredentialdescriptorjson-type","dfnText":"type","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-type"},
-"dom-publickeycredentialentity-name": {"dfnID":"dom-publickeycredentialentity-name","dfnText":"name","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460"},{"id":"ref-for-dom-publickeycredentialentity-name\u2461"},{"id":"ref-for-dom-publickeycredentialentity-name\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2463"},{"id":"ref-for-dom-publickeycredentialentity-name\u2464"},{"id":"ref-for-dom-publickeycredentialentity-name\u2465"},{"id":"ref-for-dom-publickeycredentialentity-name\u2466"},{"id":"ref-for-dom-publickeycredentialentity-name\u2467"},{"id":"ref-for-dom-publickeycredentialentity-name\u2468"},{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u24ea"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2460"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2463"}],"title":"6.4. String Handling"}],"url":"#dom-publickeycredentialentity-name"},
-"dom-publickeycredentialhints-client-device": {"dfnID":"dom-publickeycredentialhints-client-device","dfnText":"client-device","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhints-client-device"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialhints-client-device"},
-"dom-publickeycredentialhints-hybrid": {"dfnID":"dom-publickeycredentialhints-hybrid","dfnText":"hybrid","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhints-hybrid"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialhints-hybrid"},
-"dom-publickeycredentialhints-security-key": {"dfnID":"dom-publickeycredentialhints-security-key","dfnText":"security-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhints-security-key"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialhints-security-key"},
-"dom-publickeycredentialparameters-alg": {"dfnID":"dom-publickeycredentialparameters-alg","dfnText":"alg","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg\u2460"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialparameters-alg"},
-"dom-publickeycredentialparameters-type": {"dfnID":"dom-publickeycredentialparameters-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-type"},{"id":"ref-for-dom-publickeycredentialparameters-type\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-type\u2461"},{"id":"ref-for-dom-publickeycredentialparameters-type\u2462"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}],"url":"#dom-publickeycredentialparameters-type"},
-"dom-publickeycredentialrequestoptions-allowcredentials": {"dfnID":"dom-publickeycredentialrequestoptions-allowcredentials","dfnText":"allowCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2465"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2467"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2465"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2467"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2468"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2462"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2463"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2467"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2468"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u24ea"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2462"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2463"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2465"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#dom-publickeycredentialrequestoptions-allowcredentials"},
-"dom-publickeycredentialrequestoptions-challenge": {"dfnID":"dom-publickeycredentialrequestoptions-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2463"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dom-publickeycredentialrequestoptions-challenge"},
-"dom-publickeycredentialrequestoptions-extensions": {"dfnID":"dom-publickeycredentialrequestoptions-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2463"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-publickeycredentialrequestoptions-extensions"},
-"dom-publickeycredentialrequestoptions-hints": {"dfnID":"dom-publickeycredentialrequestoptions-hints","dfnText":"hints","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-hints"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-hints\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-publickeycredentialrequestoptions-hints"},
-"dom-publickeycredentialrequestoptions-rpid": {"dfnID":"dom-publickeycredentialrequestoptions-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialrequestoptions-rpid"},
-"dom-publickeycredentialrequestoptions-timeout": {"dfnID":"dom-publickeycredentialrequestoptions-timeout","dfnText":"timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout"},{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#dom-publickeycredentialrequestoptions-timeout"},
+"dom-publickeycredentialentity-name": {"dfnID":"dom-publickeycredentialentity-name","dfnText":"name","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2461"},{"id":"ref-for-dom-publickeycredentialentity-name\u2462"},{"id":"ref-for-dom-publickeycredentialentity-name\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2464"},{"id":"ref-for-dom-publickeycredentialentity-name\u2465"},{"id":"ref-for-dom-publickeycredentialentity-name\u2466"},{"id":"ref-for-dom-publickeycredentialentity-name\u2467"},{"id":"ref-for-dom-publickeycredentialentity-name\u2468"},{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2460"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2461"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2464"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-dom-publickeycredentialentity-name\u2460\u2465"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialentity-name"},
+"dom-publickeycredentialhint-client-device": {"dfnID":"dom-publickeycredentialhint-client-device","dfnText":"client-device","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhint-client-device"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-publickeycredentialhint-client-device"},
+"dom-publickeycredentialhint-hybrid": {"dfnID":"dom-publickeycredentialhint-hybrid","dfnText":"hybrid","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhint-hybrid"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-publickeycredentialhint-hybrid"},
+"dom-publickeycredentialhint-security-key": {"dfnID":"dom-publickeycredentialhint-security-key","dfnText":"security-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialhint-security-key"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#dom-publickeycredentialhint-security-key"},
+"dom-publickeycredentialparameters-alg": {"dfnID":"dom-publickeycredentialparameters-alg","dfnText":"alg","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg\u2460"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-alg\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialparameters-alg"},
+"dom-publickeycredentialparameters-type": {"dfnID":"dom-publickeycredentialparameters-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-type"},{"id":"ref-for-dom-publickeycredentialparameters-type\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialparameters-type\u2461"},{"id":"ref-for-dom-publickeycredentialparameters-type\u2462"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}],"url":"#dom-publickeycredentialparameters-type"},
+"dom-publickeycredentialrequestoptions-allowcredentials": {"dfnID":"dom-publickeycredentialrequestoptions-allowcredentials","dfnText":"allowCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2465"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2467"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2463"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2468"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u24ea"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2463"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2467"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2468"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u24ea"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2461"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2462"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2465"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2466"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2467"},{"id":"ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2468"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#dom-publickeycredentialrequestoptions-allowcredentials"},
+"dom-publickeycredentialrequestoptions-challenge": {"dfnID":"dom-publickeycredentialrequestoptions-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2463"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2464"},{"id":"ref-for-dom-publickeycredentialrequestoptions-challenge\u2465"}],"title":"16. Test Vectors"}],"url":"#dom-publickeycredentialrequestoptions-challenge"},
+"dom-publickeycredentialrequestoptions-extensions": {"dfnID":"dom-publickeycredentialrequestoptions-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-extensions\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-publickeycredentialrequestoptions-extensions"},
+"dom-publickeycredentialrequestoptions-hints": {"dfnID":"dom-publickeycredentialrequestoptions-hints","dfnText":"hints","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-hints"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-hints\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-publickeycredentialrequestoptions-hints"},
+"dom-publickeycredentialrequestoptions-rpid": {"dfnID":"dom-publickeycredentialrequestoptions-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2462"},{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-rpid\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialrequestoptions-rpid"},
+"dom-publickeycredentialrequestoptions-timeout": {"dfnID":"dom-publickeycredentialrequestoptions-timeout","dfnText":"timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout"},{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2460"},{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-timeout\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#dom-publickeycredentialrequestoptions-timeout"},
 "dom-publickeycredentialrequestoptions-userverification": {"dfnID":"dom-publickeycredentialrequestoptions-userverification","dfnText":"userVerification","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-userverification"},{"id":"ref-for-dom-publickeycredentialrequestoptions-userverification\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-userverification\u2461"},{"id":"ref-for-dom-publickeycredentialrequestoptions-userverification\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrequestoptions-userverification\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-publickeycredentialrequestoptions-userverification"},
 "dom-publickeycredentialrequestoptionsjson-allowcredentials": {"dfnID":"dom-publickeycredentialrequestoptionsjson-allowcredentials","dfnText":"allowCredentials","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-allowcredentials"},
 "dom-publickeycredentialrequestoptionsjson-challenge": {"dfnID":"dom-publickeycredentialrequestoptionsjson-challenge","dfnText":"challenge","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-challenge"},
@@ -11647,10 +12352,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialrequestoptionsjson-rpid": {"dfnID":"dom-publickeycredentialrequestoptionsjson-rpid","dfnText":"rpId","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-rpid"},
 "dom-publickeycredentialrequestoptionsjson-timeout": {"dfnID":"dom-publickeycredentialrequestoptionsjson-timeout","dfnText":"timeout","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-timeout"},
 "dom-publickeycredentialrequestoptionsjson-userverification": {"dfnID":"dom-publickeycredentialrequestoptionsjson-userverification","dfnText":"userVerification","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-userverification"},
-"dom-publickeycredentialrpentity-id": {"dfnID":"dom-publickeycredentialrpentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2465"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2466"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2468"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-publickeycredentialrpentity-id"},
-"dom-publickeycredentialtype-public-key": {"dfnID":"dom-publickeycredentialtype-public-key","dfnText":"public-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2460"},{"id":"ref-for-dom-publickeycredentialtype-public-key\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2462"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2465"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialtype-public-key"},
-"dom-publickeycredentialuserentity-displayname": {"dfnID":"dom-publickeycredentialuserentity-displayname","dfnText":"displayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2461"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2464"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2465"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2466"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2467"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2468"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2461"}],"title":"6.4. String Handling"}],"url":"#dom-publickeycredentialuserentity-displayname"},
-"dom-publickeycredentialuserentity-id": {"dfnID":"dom-publickeycredentialuserentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2465"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2468"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dom-publickeycredentialuserentity-id"},
+"dom-publickeycredentialrpentity-id": {"dfnID":"dom-publickeycredentialrpentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2465"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2467"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2468"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-publickeycredentialrpentity-id"},
+"dom-publickeycredentialtype-public-key": {"dfnID":"dom-publickeycredentialtype-public-key","dfnText":"public-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2460"},{"id":"ref-for-dom-publickeycredentialtype-public-key\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2463"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2466"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialtype-public-key"},
+"dom-publickeycredentialuserentity-displayname": {"dfnID":"dom-publickeycredentialuserentity-displayname","dfnText":"displayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2461"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2462"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2464"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2465"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2466"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2467"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2468"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2461"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2462"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialuserentity-displayname"},
+"dom-publickeycredentialuserentity-id": {"dfnID":"dom-publickeycredentialuserentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2466"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dom-publickeycredentialuserentity-id"},
 "dom-publickeycredentialuserentityjson-displayname": {"dfnID":"dom-publickeycredentialuserentityjson-displayname","dfnText":"displayName","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-displayname"},
 "dom-publickeycredentialuserentityjson-id": {"dfnID":"dom-publickeycredentialuserentityjson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-id"},
 "dom-publickeycredentialuserentityjson-name": {"dfnID":"dom-publickeycredentialuserentityjson-name","dfnText":"name","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-name"},
@@ -11660,90 +12365,91 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-registrationresponsejson-rawid": {"dfnID":"dom-registrationresponsejson-rawid","dfnText":"rawId","external":false,"refSections":[],"url":"#dom-registrationresponsejson-rawid"},
 "dom-registrationresponsejson-response": {"dfnID":"dom-registrationresponsejson-response","dfnText":"response","external":false,"refSections":[],"url":"#dom-registrationresponsejson-response"},
 "dom-registrationresponsejson-type": {"dfnID":"dom-registrationresponsejson-type","dfnText":"type","external":false,"refSections":[],"url":"#dom-registrationresponsejson-type"},
-"dom-residentkeyrequirement-discouraged": {"dfnID":"dom-residentkeyrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2461"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2462"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#dom-residentkeyrequirement-discouraged"},
-"dom-residentkeyrequirement-preferred": {"dfnID":"dom-residentkeyrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2461"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-preferred"},
-"dom-residentkeyrequirement-required": {"dfnID":"dom-residentkeyrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required"},{"id":"ref-for-dom-residentkeyrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2461"},{"id":"ref-for-dom-residentkeyrequirement-required\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-required"},
+"dom-residentkeyrequirement-discouraged": {"dfnID":"dom-residentkeyrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2461"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2462"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#dom-residentkeyrequirement-discouraged"},
+"dom-residentkeyrequirement-preferred": {"dfnID":"dom-residentkeyrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2461"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-preferred"},
+"dom-residentkeyrequirement-required": {"dfnID":"dom-residentkeyrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required"},{"id":"ref-for-dom-residentkeyrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2462"},{"id":"ref-for-dom-residentkeyrequirement-required\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-required"},
 "dom-tokenbinding-id": {"dfnID":"dom-tokenbinding-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbinding-id"},{"id":"ref-for-dom-tokenbinding-id\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbinding-id"},
 "dom-tokenbinding-status": {"dfnID":"dom-tokenbinding-status","dfnText":"status","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbinding-status"},{"id":"ref-for-dom-tokenbinding-status\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbinding-status"},
 "dom-tokenbindingstatus-present": {"dfnID":"dom-tokenbindingstatus-present","dfnText":"present","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbindingstatus-present"},{"id":"ref-for-dom-tokenbindingstatus-present\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbindingstatus-present"},
 "dom-tokenbindingstatus-supported": {"dfnID":"dom-tokenbindingstatus-supported","dfnText":"supported","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbindingstatus-supported"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbindingstatus-supported"},
-"dom-userverificationrequirement-discouraged": {"dfnID":"dom-userverificationrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-discouraged"},
-"dom-userverificationrequirement-preferred": {"dfnID":"dom-userverificationrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-preferred"},
-"dom-userverificationrequirement-required": {"dfnID":"dom-userverificationrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-required"},{"id":"ref-for-dom-userverificationrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2461"},{"id":"ref-for-dom-userverificationrequirement-required\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-userverificationrequirement-required"},
-"e0660c76": {"dfnID":"e0660c76","dfnText":"opaque origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-opaque"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
-"e1812e4c": {"dfnID":"e1812e4c","dfnText":"token binding id","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.2"},{"id":"ref-for-section-3.2\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
-"e3db52cd": {"dfnID":"e3db52cd","dfnText":"signal (for CredentialCreationOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-signal"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2460"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2461"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal"},
-"e5ea84f2": {"dfnID":"e5ea84f2","dfnText":"intersection","external":true,"refSections":[{"refs":[{"id":"ref-for-set-intersection"}],"title":"10.2.2.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#set-intersection"},
+"dom-unknowncredentialoptions-credentialid": {"dfnID":"dom-unknowncredentialoptions-credentialid","dfnText":"credentialId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-unknowncredentialoptions-credentialid"},{"id":"ref-for-dom-unknowncredentialoptions-credentialid\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"}],"url":"#dom-unknowncredentialoptions-credentialid"},
+"dom-unknowncredentialoptions-rpid": {"dfnID":"dom-unknowncredentialoptions-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-unknowncredentialoptions-rpid"},{"id":"ref-for-dom-unknowncredentialoptions-rpid\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"}],"url":"#dom-unknowncredentialoptions-rpid"},
+"dom-userverificationrequirement-discouraged": {"dfnID":"dom-userverificationrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-discouraged"},
+"dom-userverificationrequirement-preferred": {"dfnID":"dom-userverificationrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-preferred"},
+"dom-userverificationrequirement-required": {"dfnID":"dom-userverificationrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-required"},{"id":"ref-for-dom-userverificationrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2462"},{"id":"ref-for-dom-userverificationrequirement-required\u2463"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2466"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-userverificationrequirement-required"},
+"e05ae7c5": {"dfnID":"e05ae7c5","dfnText":"mediation (for CredentialCreationOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2460"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2461"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2462"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2463"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation\u2466"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation"},
+"e0660c76": {"dfnID":"e0660c76","dfnText":"opaque origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-opaque"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
+"e1812e4c": {"dfnID":"e1812e4c","dfnText":"Token Binding ID","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.2"},{"id":"ref-for-section-3.2\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
+"e3db52cd": {"dfnID":"e3db52cd","dfnText":"signal (for CredentialCreationOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-signal"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2460"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2461"},{"id":"ref-for-dom-credentialcreationoptions-signal\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal"},
 "e6ee5aa7": {"dfnID":"e6ee5aa7","dfnText":"type","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-type"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credential-type\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credential-type\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type"},
-"e97a9688": {"dfnID":"e97a9688","dfnText":"unsigned long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-unsigned-long"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2461"},{"id":"ref-for-idl-unsigned-long\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2463"},{"id":"ref-for-idl-unsigned-long\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2465"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://webidl.spec.whatwg.org/#idl-unsigned-long"},
-"e99bd18e": {"dfnID":"e99bd18e","dfnText":"relevant global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-relevant-global"},{"id":"ref-for-concept-relevant-global\u2460"},{"id":"ref-for-concept-relevant-global\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global"},
-"ea2e2fcc": {"dfnID":"ea2e2fcc","dfnText":"object","external":true,"refSections":[{"refs":[{"id":"ref-for-blob-url-entry-object"},{"id":"ref-for-blob-url-entry-object\u2460"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-blob-url-entry-object\u2461"},{"id":"ref-for-blob-url-entry-object\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-blob-url-entry-object\u2463"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-blob-url-entry-object\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-blob-url-entry-object\u2465"},{"id":"ref-for-blob-url-entry-object\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/FileAPI/#blob-url-entry-object"},
-"ea9cb8e8": {"dfnID":"ea9cb8e8","dfnText":"signal (for CredentialRequestOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-signal"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2460"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2461"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal"},
+"e97a9688": {"dfnID":"e97a9688","dfnText":"unsigned long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-unsigned-long"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2461"},{"id":"ref-for-idl-unsigned-long\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-unsigned-long\u2463"},{"id":"ref-for-idl-unsigned-long\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://webidl.spec.whatwg.org/#idl-unsigned-long"},
+"e99bd18e": {"dfnID":"e99bd18e","dfnText":"relevant global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-relevant-global"},{"id":"ref-for-concept-relevant-global\u2460"},{"id":"ref-for-concept-relevant-global\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global"},
+"ea9cb8e8": {"dfnID":"ea9cb8e8","dfnText":"signal (for CredentialRequestOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-signal"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2460"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2461"},{"id":"ref-for-dom-credentialrequestoptions-signal\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal"},
 "eb72e898": {"dfnID":"eb72e898","dfnText":"something you know","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"ee843963": {"dfnID":"ee843963","dfnText":"endpoint node","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-endpoint-node"},{"id":"ref-for-dfn-endpoint-node\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-endpoint-node\u2461"},{"id":"ref-for-dfn-endpoint-node\u2462"},{"id":"ref-for-dfn-endpoint-node\u2463"},{"id":"ref-for-dfn-endpoint-node\u2464"},{"id":"ref-for-dfn-endpoint-node\u2465"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-endpoint-node\u2466"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-endpoint-node"},
+"ee843963": {"dfnID":"ee843963","dfnText":"endpoint node","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-endpoint-node"},{"id":"ref-for-dfn-endpoint-node\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-endpoint-node\u2461"},{"id":"ref-for-dfn-endpoint-node\u2462"},{"id":"ref-for-dfn-endpoint-node\u2463"},{"id":"ref-for-dfn-endpoint-node\u2464"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-endpoint-node\u2465"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-endpoint-node"},
+"eea18c0d": {"dfnID":"eea18c0d","dfnText":"domain label","external":true,"refSections":[{"refs":[{"id":"ref-for-domain-label"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#domain-label"},
 "efd1ec5d": {"dfnID":"efd1ec5d","dfnText":"object","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-object"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://webidl.spec.whatwg.org/#idl-object"},
 "effective-resident-key-requirement-for-credential-creation": {"dfnID":"effective-resident-key-requirement-for-credential-creation","dfnText":"effective resident key requirement for credential creation","external":false,"refSections":[{"refs":[{"id":"ref-for-effective-resident-key-requirement-for-credential-creation"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#effective-resident-key-requirement-for-credential-creation"},
 "effective-user-verification-requirement-for-assertion": {"dfnID":"effective-user-verification-requirement-for-assertion","dfnText":"effective user verification requirement for assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-effective-user-verification-requirement-for-assertion"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#effective-user-verification-requirement-for-assertion"},
 "effective-user-verification-requirement-for-credential-creation": {"dfnID":"effective-user-verification-requirement-for-credential-creation","dfnText":"effective user verification requirement for credential creation","external":false,"refSections":[{"refs":[{"id":"ref-for-effective-user-verification-requirement-for-credential-creation"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#effective-user-verification-requirement-for-credential-creation"},
-"enumdef-attestationconveyancepreference": {"dfnID":"enumdef-attestationconveyancepreference","dfnText":"AttestationConveyancePreference","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference\u2460"},{"id":"ref-for-enumdef-attestationconveyancepreference\u2461"},{"id":"ref-for-enumdef-attestationconveyancepreference\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference\u2463"}],"title":"10.2.2.2. Extension Definition"}],"url":"#enumdef-attestationconveyancepreference"},
-"enumdef-authenticatorattachment": {"dfnID":"enumdef-authenticatorattachment","dfnText":"AuthenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-authenticatorattachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2463"},{"id":"ref-for-enumdef-authenticatorattachment\u2464"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}],"url":"#enumdef-authenticatorattachment"},
-"enumdef-authenticatortransport": {"dfnID":"enumdef-authenticatortransport","dfnText":"AuthenticatorTransport","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-authenticatortransport"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2461"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2462"},{"id":"ref-for-enumdef-authenticatortransport\u2463"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2464"},{"id":"ref-for-enumdef-authenticatortransport\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2466"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2467"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#enumdef-authenticatortransport"},
+"enumdef-attestationconveyancepreference": {"dfnID":"enumdef-attestationconveyancepreference","dfnText":"AttestationConveyancePreference","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-enumdef-attestationconveyancepreference\u2460"},{"id":"ref-for-enumdef-attestationconveyancepreference\u2461"},{"id":"ref-for-enumdef-attestationconveyancepreference\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}],"url":"#enumdef-attestationconveyancepreference"},
+"enumdef-authenticatorattachment": {"dfnID":"enumdef-authenticatorattachment","dfnText":"AuthenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-authenticatorattachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-enumdef-authenticatorattachment\u2463"},{"id":"ref-for-enumdef-authenticatorattachment\u2464"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}],"url":"#enumdef-authenticatorattachment"},
+"enumdef-authenticatortransport": {"dfnID":"enumdef-authenticatortransport","dfnText":"AuthenticatorTransport","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-authenticatortransport"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2461"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2462"},{"id":"ref-for-enumdef-authenticatortransport\u2463"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2464"},{"id":"ref-for-enumdef-authenticatortransport\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2466"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-enumdef-authenticatortransport\u2467"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#enumdef-authenticatortransport"},
 "enumdef-clientcapability": {"dfnID":"enumdef-clientcapability","dfnText":"ClientCapability","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-clientcapability"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-enumdef-clientcapability\u2460"},{"id":"ref-for-enumdef-clientcapability\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#enumdef-clientcapability"},
 "enumdef-largeblobsupport": {"dfnID":"enumdef-largeblobsupport","dfnText":"LargeBlobSupport","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-largeblobsupport"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#enumdef-largeblobsupport"},
-"enumdef-publickeycredentialhints": {"dfnID":"enumdef-publickeycredentialhints","dfnText":"PublicKeyCredentialHints","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-publickeycredentialhints"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialhints\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialhints\u2461"},{"id":"ref-for-enumdef-publickeycredentialhints\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#enumdef-publickeycredentialhints"},
-"enumdef-publickeycredentialtype": {"dfnID":"enumdef-publickeycredentialtype","dfnText":"PublicKeyCredentialType","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2460"},{"id":"ref-for-enumdef-publickeycredentialtype\u2461"},{"id":"ref-for-enumdef-publickeycredentialtype\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2463"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2464"},{"id":"ref-for-enumdef-publickeycredentialtype\u2465"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2467"},{"id":"ref-for-enumdef-publickeycredentialtype\u2468"},{"id":"ref-for-enumdef-publickeycredentialtype\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#enumdef-publickeycredentialtype"},
+"enumdef-publickeycredentialhint": {"dfnID":"enumdef-publickeycredentialhint","dfnText":"PublicKeyCredentialHint","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-publickeycredentialhint"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialhint\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialhint\u2461"},{"id":"ref-for-enumdef-publickeycredentialhint\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"}],"url":"#enumdef-publickeycredentialhint"},
+"enumdef-publickeycredentialtype": {"dfnID":"enumdef-publickeycredentialtype","dfnText":"PublicKeyCredentialType","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2460"},{"id":"ref-for-enumdef-publickeycredentialtype\u2461"},{"id":"ref-for-enumdef-publickeycredentialtype\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2463"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2464"},{"id":"ref-for-enumdef-publickeycredentialtype\u2465"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2467"},{"id":"ref-for-enumdef-publickeycredentialtype\u2468"},{"id":"ref-for-enumdef-publickeycredentialtype\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-enumdef-publickeycredentialtype\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#enumdef-publickeycredentialtype"},
 "enumdef-residentkeyrequirement": {"dfnID":"enumdef-residentkeyrequirement","dfnText":"ResidentKeyRequirement","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-residentkeyrequirement"},{"id":"ref-for-enumdef-residentkeyrequirement\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-enumdef-residentkeyrequirement\u2461"},{"id":"ref-for-enumdef-residentkeyrequirement\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#enumdef-residentkeyrequirement"},
 "enumdef-tokenbindingstatus": {"dfnID":"enumdef-tokenbindingstatus","dfnText":"TokenBindingStatus","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-tokenbindingstatus"},{"id":"ref-for-enumdef-tokenbindingstatus\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#enumdef-tokenbindingstatus"},
 "enumdef-userverificationrequirement": {"dfnID":"enumdef-userverificationrequirement","dfnText":"UserVerificationRequirement","external":false,"refSections":[{"refs":[{"id":"ref-for-enumdef-userverificationrequirement"},{"id":"ref-for-enumdef-userverificationrequirement\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-enumdef-userverificationrequirement\u2461"},{"id":"ref-for-enumdef-userverificationrequirement\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-enumdef-userverificationrequirement\u2463"},{"id":"ref-for-enumdef-userverificationrequirement\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-enumdef-userverificationrequirement\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#enumdef-userverificationrequirement"},
-"extension-identifier": {"dfnID":"extension-identifier","dfnText":"extension identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-extension-identifier"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-extension-identifier\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-extension-identifier\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-extension-identifier\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-extension-identifier\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-extension-identifier\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-extension-identifier\u2465"},{"id":"ref-for-extension-identifier\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-extension-identifier\u2467"},{"id":"ref-for-extension-identifier\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u24ea"},{"id":"ref-for-extension-identifier\u2460\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2462"},{"id":"ref-for-extension-identifier\u2460\u2463"},{"id":"ref-for-extension-identifier\u2460\u2464"},{"id":"ref-for-extension-identifier\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2466"},{"id":"ref-for-extension-identifier\u2460\u2467"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2468"},{"id":"ref-for-extension-identifier\u2461\u24ea"},{"id":"ref-for-extension-identifier\u2461\u2460"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2462"},{"id":"ref-for-extension-identifier\u2461\u2463"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2464"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#extension-identifier"},
-"f023908c": {"dfnID":"f023908c","dfnText":"user mediation","external":true,"refSections":[{"refs":[{"id":"ref-for-user-mediated"},{"id":"ref-for-user-mediated\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-user-mediated\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-mediated\u2462"},{"id":"ref-for-user-mediated\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-mediated\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-mediated\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-mediated\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://w3c.github.io/webappsec-credential-management/#user-mediated"},
-"f02cd417": {"dfnID":"f02cd417","dfnText":"iterate","external":true,"refSections":[{"refs":[{"id":"ref-for-list-iterate"},{"id":"ref-for-list-iterate\u2460"},{"id":"ref-for-list-iterate\u2461"},{"id":"ref-for-list-iterate\u2462"},{"id":"ref-for-list-iterate\u2463"},{"id":"ref-for-list-iterate\u2464"},{"id":"ref-for-list-iterate\u2465"},{"id":"ref-for-list-iterate\u2466"},{"id":"ref-for-list-iterate\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-iterate\u2468"},{"id":"ref-for-list-iterate\u2460\u24ea"},{"id":"ref-for-list-iterate\u2460\u2460"},{"id":"ref-for-list-iterate\u2460\u2461"},{"id":"ref-for-list-iterate\u2460\u2462"},{"id":"ref-for-list-iterate\u2460\u2463"},{"id":"ref-for-list-iterate\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-list-iterate\u2460\u2468"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-list-iterate\u2461\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2460"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-list-iterate\u2461\u2461"},{"id":"ref-for-list-iterate\u2461\u2462"},{"id":"ref-for-list-iterate\u2461\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"https://infra.spec.whatwg.org/#list-iterate"},
+"extension-identifier": {"dfnID":"extension-identifier","dfnText":"extension identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-extension-identifier"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-extension-identifier\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-extension-identifier\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-extension-identifier\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-extension-identifier\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-extension-identifier\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-extension-identifier\u2465"},{"id":"ref-for-extension-identifier\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-extension-identifier\u2467"},{"id":"ref-for-extension-identifier\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u24ea"},{"id":"ref-for-extension-identifier\u2460\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2462"},{"id":"ref-for-extension-identifier\u2460\u2463"},{"id":"ref-for-extension-identifier\u2460\u2464"},{"id":"ref-for-extension-identifier\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2466"},{"id":"ref-for-extension-identifier\u2460\u2467"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-extension-identifier\u2460\u2468"},{"id":"ref-for-extension-identifier\u2461\u24ea"},{"id":"ref-for-extension-identifier\u2461\u2460"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2462"},{"id":"ref-for-extension-identifier\u2461\u2463"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2464"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-extension-identifier\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#extension-identifier"},
+"f023908c": {"dfnID":"f023908c","dfnText":"user mediation","external":true,"refSections":[{"refs":[{"id":"ref-for-user-mediated"},{"id":"ref-for-user-mediated\u2460"},{"id":"ref-for-user-mediated\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-user-mediated\u2462"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-user-mediated\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-user-mediated\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-mediated\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://w3c.github.io/webappsec-credential-management/#user-mediated"},
 "f41069dd": {"dfnID":"f41069dd","dfnText":"[[type]]","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-type-slot"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot"},
-"f44435ef": {"dfnID":"f44435ef","dfnText":"section 3.2 key protection types","external":true,"refSections":[{"refs":[{"id":"ref-for-key-protection-types"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types"},
-"f456317b": {"dfnID":"f456317b","dfnText":"section 3.6.2 public key representation formats","external":true,"refSections":[{"refs":[{"id":"ref-for-public-key-representation-formats"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats"},
+"f456317b": {"dfnID":"f456317b","dfnText":"Section 3.6.2 Public Key Representation Formats","external":true,"refSections":[{"refs":[{"id":"ref-for-public-key-representation-formats"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats"},
 "f8de33a3": {"dfnID":"f8de33a3","dfnText":"long","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-long"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}],"url":"https://webidl.spec.whatwg.org/#idl-long"},
-"f937b7b6": {"dfnID":"f937b7b6","dfnText":"continue","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-continue"},{"id":"ref-for-iteration-continue\u2460"},{"id":"ref-for-iteration-continue\u2461"},{"id":"ref-for-iteration-continue\u2462"},{"id":"ref-for-iteration-continue\u2463"},{"id":"ref-for-iteration-continue\u2464"},{"id":"ref-for-iteration-continue\u2465"},{"id":"ref-for-iteration-continue\u2466"},{"id":"ref-for-iteration-continue\u2467"},{"id":"ref-for-iteration-continue\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u24ea"},{"id":"ref-for-iteration-continue\u2460\u2460"},{"id":"ref-for-iteration-continue\u2460\u2461"},{"id":"ref-for-iteration-continue\u2460\u2462"},{"id":"ref-for-iteration-continue\u2460\u2463"},{"id":"ref-for-iteration-continue\u2460\u2464"},{"id":"ref-for-iteration-continue\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u2466"},{"id":"ref-for-iteration-continue\u2460\u2467"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://infra.spec.whatwg.org/#iteration-continue"},
-"f9c635f5": {"dfnID":"f9c635f5","dfnText":"conditional","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2463"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2464"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2465"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2466"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2467"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2468"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2462"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2463"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2464"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2465"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2466"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2467"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2461"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional"},
+"f937b7b6": {"dfnID":"f937b7b6","dfnText":"continue","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-continue"},{"id":"ref-for-iteration-continue\u2460"},{"id":"ref-for-iteration-continue\u2461"},{"id":"ref-for-iteration-continue\u2462"},{"id":"ref-for-iteration-continue\u2463"},{"id":"ref-for-iteration-continue\u2464"},{"id":"ref-for-iteration-continue\u2465"},{"id":"ref-for-iteration-continue\u2466"},{"id":"ref-for-iteration-continue\u2467"},{"id":"ref-for-iteration-continue\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u24ea"},{"id":"ref-for-iteration-continue\u2460\u2460"},{"id":"ref-for-iteration-continue\u2460\u2461"},{"id":"ref-for-iteration-continue\u2460\u2462"},{"id":"ref-for-iteration-continue\u2460\u2463"},{"id":"ref-for-iteration-continue\u2460\u2464"},{"id":"ref-for-iteration-continue\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-iteration-continue\u2460\u2466"},{"id":"ref-for-iteration-continue\u2460\u2467"},{"id":"ref-for-iteration-continue\u2460\u2468"},{"id":"ref-for-iteration-continue\u2461\u24ea"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-iteration-continue\u2461\u2460"},{"id":"ref-for-iteration-continue\u2461\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-iteration-continue\u2461\u2462"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://infra.spec.whatwg.org/#iteration-continue"},
+"f9c635f5": {"dfnID":"f9c635f5","dfnText":"conditional","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2462"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2464"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2465"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2466"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2467"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2468"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2461"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2462"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2463"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2464"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2465"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2466"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2460\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2460"},{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-dom-credentialmediationrequirement-conditional\u2461\u2464"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional"},
 "faf954d6": {"dfnID":"faf954d6","dfnText":"browsing context","external":true,"refSections":[{"refs":[{"id":"ref-for-browsing-context"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-browsing-context\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
-"fbc75291": {"dfnID":"fbc75291","dfnText":"token binding","external":true,"refSections":[{"refs":[{"id":"ref-for-section-1"},{"id":"ref-for-section-1\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-1"},
-"fc736137": {"dfnID":"fc736137","dfnText":"textarea","external":true,"refSections":[{"refs":[{"id":"ref-for-the-textarea-element"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element"},
+"fbc75291": {"dfnID":"fbc75291","dfnText":"Token Binding","external":true,"refSections":[{"refs":[{"id":"ref-for-section-1"},{"id":"ref-for-section-1\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-1"},
+"fc736137": {"dfnID":"fc736137","dfnText":"textarea","external":true,"refSections":[{"refs":[{"id":"ref-for-the-textarea-element"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element"},
 "feac4ab3": {"dfnID":"feac4ab3","dfnText":"same site","external":true,"refSections":[{"refs":[{"id":"ref-for-same-site"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-same-site\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
-"first-factor-roaming-authenticator": {"dfnID":"first-factor-roaming-authenticator","dfnText":"First-factor roaming authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-first-factor-roaming-authenticator"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-first-factor-roaming-authenticator\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#first-factor-roaming-authenticator"},
 "generating-authenticator": {"dfnID":"generating-authenticator","dfnText":"Generating Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-generating-authenticator"},{"id":"ref-for-generating-authenticator\u2460"},{"id":"ref-for-generating-authenticator\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-generating-authenticator\u2462"}],"title":"6.1.3. Credential Backup State"}],"url":"#generating-authenticator"},
 "get-credentials": {"dfnID":"get-credentials","dfnText":"Get Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-get-credentials"}],"title":"11.6. Get Credentials"}],"url":"#get-credentials"},
-"human-palatability": {"dfnID":"human-palatability","dfnText":"Human Palatability","external":false,"refSections":[{"refs":[{"id":"ref-for-human-palatability"},{"id":"ref-for-human-palatability\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-human-palatability\u2461"},{"id":"ref-for-human-palatability\u2462"},{"id":"ref-for-human-palatability\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2464"},{"id":"ref-for-human-palatability\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#human-palatability"},
+"human-palatability": {"dfnID":"human-palatability","dfnText":"Human Palatability","external":false,"refSections":[{"refs":[{"id":"ref-for-human-palatability"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-human-palatability\u2460"},{"id":"ref-for-human-palatability\u2461"},{"id":"ref-for-human-palatability\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2463"},{"id":"ref-for-human-palatability\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"#human-palatability"},
 "largeblob": {"dfnID":"largeblob","dfnText":"largeBlob","external":false,"refSections":[{"refs":[{"id":"ref-for-largeblob"},{"id":"ref-for-largeblob\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-largeblob\u2461"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-largeblob\u2462"}],"title":"11.5. Add Credential"}],"url":"#largeblob"},
-"multi-device-credential": {"dfnID":"multi-device-credential","dfnText":"multi-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-device-credential"},{"id":"ref-for-multi-device-credential\u2460"},{"id":"ref-for-multi-device-credential\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-multi-device-credential\u2462"},{"id":"ref-for-multi-device-credential\u2463"},{"id":"ref-for-multi-device-credential\u2464"},{"id":"ref-for-multi-device-credential\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-multi-device-credential\u2466"},{"id":"ref-for-multi-device-credential\u2467"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-multi-device-credential\u2468"}],"title":"10.2.2.2.1. AAGUIDs"}],"url":"#multi-device-credential"},
+"multi-device-credential": {"dfnID":"multi-device-credential","dfnText":"multi-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-device-credential"},{"id":"ref-for-multi-device-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-multi-device-credential\u2461"},{"id":"ref-for-multi-device-credential\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-multi-device-credential\u2463"},{"id":"ref-for-multi-device-credential\u2464"},{"id":"ref-for-multi-device-credential\u2465"},{"id":"ref-for-multi-device-credential\u2466"}],"title":"6.1.3. Credential Backup State"}],"url":"#multi-device-credential"},
 "multi-factor-capable": {"dfnID":"multi-factor-capable","dfnText":"multi-factor capable","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-factor-capable"},{"id":"ref-for-multi-factor-capable\u2460"},{"id":"ref-for-multi-factor-capable\u2461"},{"id":"ref-for-multi-factor-capable\u2462"},{"id":"ref-for-multi-factor-capable\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-multi-factor-capable\u2464"},{"id":"ref-for-multi-factor-capable\u2465"}],"title":"6.2.3. Authentication Factor Capability"}],"url":"#multi-factor-capable"},
-"non-discoverable-credential": {"dfnID":"non-discoverable-credential","dfnText":"Non-Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-non-discoverable-credential"},{"id":"ref-for-non-discoverable-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#non-discoverable-credential"},
+"non-discoverable-credential": {"dfnID":"non-discoverable-credential","dfnText":"Non-Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-non-discoverable-credential"},{"id":"ref-for-non-discoverable-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#non-discoverable-credential"},
 "non-resident-credential": {"dfnID":"non-resident-credential","dfnText":"Non-Resident Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-non-resident-credential"}],"title":"4. Terminology"}],"url":"#non-resident-credential"},
-"none": {"dfnID":"none","dfnText":"None","external":false,"refSections":[{"refs":[{"id":"ref-for-none"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-none\u2460"},{"id":"ref-for-none\u2461"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-none\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-none\u2463"},{"id":"ref-for-none\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-none\u2465"},{"id":"ref-for-none\u2466"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-none\u2467"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-none\u2468"}],"title":"13.4.4. Attestation Limitations"}],"url":"#none"},
-"passkey": {"dfnID":"passkey","dfnText":"Passkey","external":false,"refSections":[],"url":"#passkey"},
-"passkey-platform-authenticator": {"dfnID":"passkey-platform-authenticator","dfnText":"Passkey platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey-platform-authenticator"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"}],"url":"#passkey-platform-authenticator"},
+"none": {"dfnID":"none","dfnText":"None","external":false,"refSections":[{"refs":[{"id":"ref-for-none"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-none\u2460"},{"id":"ref-for-none\u2461"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-none\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-none\u2463"},{"id":"ref-for-none\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-none\u2465"},{"id":"ref-for-none\u2466"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-none\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-none\u2468"}],"title":"16. Test Vectors"}],"url":"#none"},
+"passkey": {"dfnID":"passkey","dfnText":"Passkey","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#passkey"},
+"passkey-platform-authenticator": {"dfnID":"passkey-platform-authenticator","dfnText":"Passkey platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey-platform-authenticator"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-passkey-platform-authenticator\u2460"},{"id":"ref-for-passkey-platform-authenticator\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#passkey-platform-authenticator"},
+"passkey-roaming-authenticator": {"dfnID":"passkey-roaming-authenticator","dfnText":"Passkey roaming authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey-roaming-authenticator"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-passkey-roaming-authenticator\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#passkey-roaming-authenticator"},
 "platform-attachment": {"dfnID":"platform-attachment","dfnText":"platform attachment","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-attachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-attachment\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-attachment\u2461"},{"id":"ref-for-platform-attachment\u2462"},{"id":"ref-for-platform-attachment\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-attachment\u2464"}],"title":"11.2. Virtual Authenticators"}],"url":"#platform-attachment"},
-"platform-authenticators": {"dfnID":"platform-authenticators","dfnText":"platform authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-platform-authenticators\u2460"},{"id":"ref-for-platform-authenticators\u2461"},{"id":"ref-for-platform-authenticators\u2462"},{"id":"ref-for-platform-authenticators\u2463"},{"id":"ref-for-platform-authenticators\u2464"},{"id":"ref-for-platform-authenticators\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2466"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-platform-authenticators\u2468"},{"id":"ref-for-platform-authenticators\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2460"},{"id":"ref-for-platform-authenticators\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2463"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2464"},{"id":"ref-for-platform-authenticators\u2460\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2466"},{"id":"ref-for-platform-authenticators\u2460\u2467"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2468"},{"id":"ref-for-platform-authenticators\u2461\u24ea"},{"id":"ref-for-platform-authenticators\u2461\u2460"},{"id":"ref-for-platform-authenticators\u2461\u2461"},{"id":"ref-for-platform-authenticators\u2461\u2462"},{"id":"ref-for-platform-authenticators\u2461\u2463"},{"id":"ref-for-platform-authenticators\u2461\u2464"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2467"},{"id":"ref-for-platform-authenticators\u2461\u2468"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u24ea"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2463"},{"id":"ref-for-platform-authenticators\u2462\u2464"}],"title":"14.5.3. Privacy Between Operating System Accounts"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2465"}],"title":"15. Accessibility Considerations"}],"url":"#platform-authenticators"},
+"platform-authenticators": {"dfnID":"platform-authenticators","dfnText":"platform authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-platform-authenticators\u2460"},{"id":"ref-for-platform-authenticators\u2461"},{"id":"ref-for-platform-authenticators\u2462"},{"id":"ref-for-platform-authenticators\u2463"},{"id":"ref-for-platform-authenticators\u2464"},{"id":"ref-for-platform-authenticators\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2466"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-platform-authenticators\u2468"},{"id":"ref-for-platform-authenticators\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2462"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2463"},{"id":"ref-for-platform-authenticators\u2460\u2464"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2465"},{"id":"ref-for-platform-authenticators\u2460\u2466"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2467"},{"id":"ref-for-platform-authenticators\u2460\u2468"},{"id":"ref-for-platform-authenticators\u2461\u24ea"},{"id":"ref-for-platform-authenticators\u2461\u2460"},{"id":"ref-for-platform-authenticators\u2461\u2461"},{"id":"ref-for-platform-authenticators\u2461\u2462"},{"id":"ref-for-platform-authenticators\u2461\u2463"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2464"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2465"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2466"},{"id":"ref-for-platform-authenticators\u2461\u2467"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2468"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2460"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2462"},{"id":"ref-for-platform-authenticators\u2462\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2464"}],"title":"15. Accessibility Considerations"}],"url":"#platform-authenticators"},
 "platform-credential": {"dfnID":"platform-credential","dfnText":"platform credential","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-credential\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-credential\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-platform-credential\u2462"},{"id":"ref-for-platform-credential\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#platform-credential"},
-"prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
-"public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"},{"id":"ref-for-public-key-credential\u2462\u2465"},{"id":"ref-for-public-key-credential\u2462\u2466"},{"id":"ref-for-public-key-credential\u2462\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"},{"id":"ref-for-public-key-credential\u2463\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2463"},{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2468"},{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"},{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"},{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"},{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2467"},{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"},{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"},{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"},{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},
-"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"},{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"},{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"},{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"},{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"},{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2460"},{"id":"ref-for-public-key-credential-source\u2465\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"},{"id":"ref-for-public-key-credential-source\u2465\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2468"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"},{"id":"ref-for-public-key-credential-source\u2466\u2466"},{"id":"ref-for-public-key-credential-source\u2466\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2460"},{"id":"ref-for-public-key-credential-source\u2467\u2461"},{"id":"ref-for-public-key-credential-source\u2467\u2462"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2465"},{"id":"ref-for-public-key-credential-source\u2467\u2466"},{"id":"ref-for-public-key-credential-source\u2467\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
-"public-key-credential-source-id": {"dfnID":"public-key-credential-source-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-id"},{"id":"ref-for-public-key-credential-source-id\u2460"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2464"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2465"},{"id":"ref-for-public-key-credential-source-id\u2466"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-id"},
-"public-key-credential-source-managing-authenticator": {"dfnID":"public-key-credential-source-managing-authenticator","dfnText":"managing authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2462"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2463"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2464"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2465"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2466"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2468"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#public-key-credential-source-managing-authenticator"},
+"prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-prf\u2461"},{"id":"ref-for-prf\u2462"},{"id":"ref-for-prf\u2463"},{"id":"ref-for-prf\u2464"}],"title":"16.2.1. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2465"}],"title":"16.2.1.1. Web Authentication API"},{"refs":[{"id":"ref-for-prf\u2466"}],"title":"16.2.1.2. CTAP2 hmac-secret extension"}],"url":"#prf"},
+"public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"},{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2466"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2467"},{"id":"ref-for-public-key-credential\u2462\u2468"},{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2462"},{"id":"ref-for-public-key-credential\u2463\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"},{"id":"ref-for-public-key-credential\u2463\u2467"},{"id":"ref-for-public-key-credential\u2463\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"},{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"},{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"},{"id":"ref-for-public-key-credential\u2465\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"},{"id":"ref-for-public-key-credential\u2466\u2463"},{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"},{"id":"ref-for-public-key-credential\u2467\u2462"},{"id":"ref-for-public-key-credential\u2467\u2463"},{"id":"ref-for-public-key-credential\u2467\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},
+"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"},{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"},{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"},{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"},{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2460"},{"id":"ref-for-public-key-credential-source\u2465\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"},{"id":"ref-for-public-key-credential-source\u2465\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"},{"id":"ref-for-public-key-credential-source\u2465\u2468"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"},{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2466"},{"id":"ref-for-public-key-credential-source\u2466\u2467"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"},{"id":"ref-for-public-key-credential-source\u2467\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2461"},{"id":"ref-for-public-key-credential-source\u2467\u2462"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"},{"id":"ref-for-public-key-credential-source\u2467\u2465"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
+"public-key-credential-source-id": {"dfnID":"public-key-credential-source-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-id"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2461"},{"id":"ref-for-public-key-credential-source-id\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2466"},{"id":"ref-for-public-key-credential-source-id\u2467"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-id"},
+"public-key-credential-source-managing-authenticator": {"dfnID":"public-key-credential-source-managing-authenticator","dfnText":"managing authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2462"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2463"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2464"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2465"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2466"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2468"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}],"url":"#public-key-credential-source-managing-authenticator"},
 "public-key-credential-source-mutable-item": {"dfnID":"public-key-credential-source-mutable-item","dfnText":"mutable item","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-mutable-item"}],"title":"4. Terminology"}],"url":"#public-key-credential-source-mutable-item"},
-"public-key-credential-source-otherui": {"dfnID":"public-key-credential-source-otherui","dfnText":"otherUI","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-otherui"},{"id":"ref-for-public-key-credential-source-otherui\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#public-key-credential-source-otherui"},
+"public-key-credential-source-otherui": {"dfnID":"public-key-credential-source-otherui","dfnText":"otherUI","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-otherui"},{"id":"ref-for-public-key-credential-source-otherui\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2461"},{"id":"ref-for-public-key-credential-source-otherui\u2462"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2465"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-otherui"},
 "public-key-credential-source-privatekey": {"dfnID":"public-key-credential-source-privatekey","dfnText":"privateKey","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-privatekey"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-privatekey\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-privatekey\u2461"},{"id":"ref-for-public-key-credential-source-privatekey\u2462"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-privatekey"},
-"public-key-credential-source-rpid": {"dfnID":"public-key-credential-source-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-rpid"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2463"},{"id":"ref-for-public-key-credential-source-rpid\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2465"},{"id":"ref-for-public-key-credential-source-rpid\u2466"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2467"},{"id":"ref-for-public-key-credential-source-rpid\u2468"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-rpid"},
+"public-key-credential-source-rpid": {"dfnID":"public-key-credential-source-rpid","dfnText":"rpId","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-rpid"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2464"},{"id":"ref-for-public-key-credential-source-rpid\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-rpid\u2466"},{"id":"ref-for-public-key-credential-source-rpid\u2467"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-rpid"},
 "public-key-credential-source-type": {"dfnID":"public-key-credential-source-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-type\u2460"},{"id":"ref-for-public-key-credential-source-type\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-type\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-type\u2463"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-type"},
-"public-key-credential-source-userhandle": {"dfnID":"public-key-credential-source-userhandle","dfnText":"userHandle","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-userhandle"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2461"},{"id":"ref-for-public-key-credential-source-userhandle\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2464"},{"id":"ref-for-public-key-credential-source-userhandle\u2465"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-userhandle"},
+"public-key-credential-source-userhandle": {"dfnID":"public-key-credential-source-userhandle","dfnText":"userHandle","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-userhandle"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2462"},{"id":"ref-for-public-key-credential-source-userhandle\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2465"},{"id":"ref-for-public-key-credential-source-userhandle\u2466"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-userhandle"},
 "publickey-credentials-create-feature": {"dfnID":"publickey-credentials-create-feature","dfnText":"publickey-credentials-create","external":false,"refSections":[],"url":"#publickey-credentials-create-feature"},
 "publickey-credentials-get-feature": {"dfnID":"publickey-credentials-get-feature","dfnText":"publickey-credentials-get","external":false,"refSections":[{"refs":[{"id":"ref-for-publickey-credentials-get-feature"}],"title":"5.10. Using Web Authentication within iframe elements"}],"url":"#publickey-credentials-get-feature"},
-"publickeycredential": {"dfnID":"publickeycredential","dfnText":"PublicKeyCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-publickeycredential\u2460"},{"id":"ref-for-publickeycredential\u2461"},{"id":"ref-for-publickeycredential\u2462"},{"id":"ref-for-publickeycredential\u2463"},{"id":"ref-for-publickeycredential\u2464"},{"id":"ref-for-publickeycredential\u2465"},{"id":"ref-for-publickeycredential\u2466"},{"id":"ref-for-publickeycredential\u2467"},{"id":"ref-for-publickeycredential\u2468"},{"id":"ref-for-publickeycredential\u2460\u24ea"},{"id":"ref-for-publickeycredential\u2460\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2461"},{"id":"ref-for-publickeycredential\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2464"},{"id":"ref-for-publickeycredential\u2460\u2465"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2468"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u24ea"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2461"},{"id":"ref-for-publickeycredential\u2461\u2462"},{"id":"ref-for-publickeycredential\u2461\u2463"},{"id":"ref-for-publickeycredential\u2461\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2467"}],"title":"13.4.4. Attestation Limitations"}],"url":"#publickeycredential"},
-"publickeycredential-issuing-a-credential-request-to-an-authenticator": {"dfnID":"publickeycredential-issuing-a-credential-request-to-an-authenticator","dfnText":"Issuing a Credential Request to an Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator"},{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"}],"url":"#publickeycredential-issuing-a-credential-request-to-an-authenticator"},
+"publickeycredential": {"dfnID":"publickeycredential","dfnText":"PublicKeyCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-publickeycredential\u2460"},{"id":"ref-for-publickeycredential\u2461"},{"id":"ref-for-publickeycredential\u2462"},{"id":"ref-for-publickeycredential\u2463"},{"id":"ref-for-publickeycredential\u2464"},{"id":"ref-for-publickeycredential\u2465"},{"id":"ref-for-publickeycredential\u2466"},{"id":"ref-for-publickeycredential\u2467"},{"id":"ref-for-publickeycredential\u2468"},{"id":"ref-for-publickeycredential\u2460\u24ea"},{"id":"ref-for-publickeycredential\u2460\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2461"},{"id":"ref-for-publickeycredential\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2463"},{"id":"ref-for-publickeycredential\u2460\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2466"},{"id":"ref-for-publickeycredential\u2460\u2467"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2462"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2464"},{"id":"ref-for-publickeycredential\u2461\u2465"},{"id":"ref-for-publickeycredential\u2461\u2466"},{"id":"ref-for-publickeycredential\u2461\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2468"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2461"},{"id":"ref-for-publickeycredential\u2462\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2463"}],"title":"13.4.4. Attestation Limitations"}],"url":"#publickeycredential"},
+"publickeycredential-issuing-a-credential-request-to-an-authenticator": {"dfnID":"publickeycredential-issuing-a-credential-request-to-an-authenticator","dfnText":"Issuing a Credential Request to an Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator"},{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"}],"url":"#publickeycredential-issuing-a-credential-request-to-an-authenticator"},
 "rate-limiting": {"dfnID":"rate-limiting","dfnText":"Rate Limiting","external":false,"refSections":[{"refs":[{"id":"ref-for-rate-limiting"},{"id":"ref-for-rate-limiting\u2460"}],"title":"4. Terminology"}],"url":"#rate-limiting"},
-"recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
-"registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
-"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"},{"id":"ref-for-registration-ceremony\u2460\u2460"},{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"},{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"},{"id":"ref-for-registration-ceremony\u2461\u2460"},{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2464"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
-"registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2462"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2463"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2464"},{"id":"ref-for-registration-extension\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
-"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"},{"id":"ref-for-relying-party\u2467\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"},{"id":"ref-for-relying-party\u2468\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"},{"id":"ref-for-relying-party\u2468\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"},{"id":"ref-for-relying-party\u2460\u24ea\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"},{"id":"ref-for-relying-party\u2460\u24ea\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2465"},{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2468"},{"id":"ref-for-relying-party\u2460\u2460\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2460\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2460"},{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2461"},{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2467"},{"id":"ref-for-relying-party\u2460\u2462\u2468"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2464"},{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2467"},{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2463"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2464"},{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2460"},{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"},{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2461"},{"id":"ref-for-relying-party\u2460\u2468\u2462"},{"id":"ref-for-relying-party\u2460\u2468\u2463"},{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"},{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2467"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"},{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2461\u2468"},{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2465"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2466"},{"id":"ref-for-relying-party\u2461\u2468\u2467"},{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2460"},{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"},{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"},{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2464"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2468"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u24ea"}],"title":"10.2.2.2.2. Attestation calculations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2460"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2462"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2463"},{"id":"ref-for-relying-party\u2463\u2462\u2464"},{"id":"ref-for-relying-party\u2463\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2466"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2467"},{"id":"ref-for-relying-party\u2463\u2462\u2468"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2463\u2468"},{"id":"ref-for-relying-party\u2463\u2464\u24ea"},{"id":"ref-for-relying-party\u2463\u2464\u2460"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2461"},{"id":"ref-for-relying-party\u2463\u2464\u2462"},{"id":"ref-for-relying-party\u2463\u2464\u2463"},{"id":"ref-for-relying-party\u2463\u2464\u2464"},{"id":"ref-for-relying-party\u2463\u2464\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
+"recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
+"registrable-origin-label": {"dfnID":"registrable-origin-label","dfnText":"Registrable Origin Label","external":false,"refSections":[{"refs":[{"id":"ref-for-registrable-origin-label"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registrable-origin-label\u2460"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-registrable-origin-label\u2461"},{"id":"ref-for-registrable-origin-label\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"#registrable-origin-label"},
+"registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"17. Acknowledgements"}],"url":"#registration"},
+"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"},{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2467"}],"title":"16. Test Vectors"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2468"}],"title":"16.1.1. ES256 Credential with No Attestation"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u24ea"}],"title":"16.1.2. ES256 Credential with Self Attestation"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2460"}],"title":"16.1.3. ES256 Credential with \"crossOrigin\": true in clientDataJSON"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2461"}],"title":"16.1.4. ES256 Credential with \"topOrigin\" in clientDataJSON"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2462"}],"title":"16.1.5. ES256 Credential with very long credential ID"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2463"}],"title":"16.1.6. Packed Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2464"}],"title":"16.1.7. Packed Attestation with ES384 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2465"}],"title":"16.1.8. Packed Attestation with ES512 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2466"}],"title":"16.1.9. Packed Attestation with RS256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2467"}],"title":"16.1.10. Packed Attestation with Ed25519 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2462\u2468"}],"title":"16.1.11. TPM Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2463\u24ea"}],"title":"16.1.12. Android Key Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2463\u2460"}],"title":"16.1.13. Apple Anonymous Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2463\u2461"}],"title":"16.1.14. FIDO U2F Attestation with ES256 Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2463\u2462"},{"id":"ref-for-registration-ceremony\u2463\u2463"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#registration-ceremony"},
+"registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"},{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
+"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"},{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"},{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"},{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"},{"id":"ref-for-relying-party\u2460\u24ea\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"},{"id":"ref-for-relying-party\u2460\u24ea\u2467"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"},{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"},{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"},{"id":"ref-for-relying-party\u2460\u2463\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"},{"id":"ref-for-relying-party\u2460\u2463\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2462"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"},{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u24ea"},{"id":"ref-for-relying-party\u2460\u2467\u2460"},{"id":"ref-for-relying-party\u2460\u2467\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"},{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2461"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2462"},{"id":"ref-for-relying-party\u2460\u2468\u2463"},{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"},{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"},{"id":"ref-for-relying-party\u2461\u2460\u2461"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"},{"id":"ref-for-relying-party\u2461\u2460\u2464"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"},{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2461\u2468"},{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"},{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"},{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"},{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"8.2.1. Certificate Requirements for Packed Attestation Statements"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"},{"id":"ref-for-relying-party\u2462\u24ea\u2467"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"},{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u24ea"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2460"},{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2468"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"},{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2463"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"},{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"},{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2464"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"},{"id":"ref-for-relying-party\u2463\u2462\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2464"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2465"}],"title":"15.1. Recommended Range for Ceremony Timeouts"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2466"},{"id":"ref-for-relying-party\u2463\u2462\u2467"},{"id":"ref-for-relying-party\u2463\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u2463\u24ea"}],"title":"16. Test Vectors"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},
 "remove-all-credentials": {"dfnID":"remove-all-credentials","dfnText":"Remove All Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-all-credentials"}],"title":"11.8. Remove All Credentials"}],"url":"#remove-all-credentials"},
 "remove-credential": {"dfnID":"remove-credential","dfnText":"Remove Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-credential"}],"title":"11.7. Remove Credential"}],"url":"#remove-credential"},
@@ -11752,54 +12458,53 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "resident-key": {"dfnID":"resident-key","dfnText":"Resident Key","external":false,"refSections":[{"refs":[{"id":"ref-for-resident-key"},{"id":"ref-for-resident-key\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-resident-key\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#resident-key"},
 "roaming-authenticators": {"dfnID":"roaming-authenticators","dfnText":"roaming authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-roaming-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-roaming-authenticators\u2460"},{"id":"ref-for-roaming-authenticators\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-roaming-authenticators\u2462"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-roaming-authenticators\u2463"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-roaming-authenticators\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-roaming-authenticators\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-roaming-authenticators\u2466"},{"id":"ref-for-roaming-authenticators\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-roaming-authenticators\u2468"},{"id":"ref-for-roaming-authenticators\u2460\u24ea"},{"id":"ref-for-roaming-authenticators\u2460\u2460"},{"id":"ref-for-roaming-authenticators\u2460\u2461"},{"id":"ref-for-roaming-authenticators\u2460\u2462"},{"id":"ref-for-roaming-authenticators\u2460\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-roaming-authenticators\u2460\u2464"},{"id":"ref-for-roaming-authenticators\u2460\u2465"},{"id":"ref-for-roaming-authenticators\u2460\u2466"},{"id":"ref-for-roaming-authenticators\u2460\u2467"},{"id":"ref-for-roaming-authenticators\u2460\u2468"},{"id":"ref-for-roaming-authenticators\u2461\u24ea"},{"id":"ref-for-roaming-authenticators\u2461\u2460"},{"id":"ref-for-roaming-authenticators\u2461\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-roaming-authenticators\u2461\u2462"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-roaming-authenticators\u2461\u2463"},{"id":"ref-for-roaming-authenticators\u2461\u2464"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-roaming-authenticators\u2461\u2465"},{"id":"ref-for-roaming-authenticators\u2461\u2466"}],"title":"15. Accessibility Considerations"}],"url":"#roaming-authenticators"},
 "roaming-credential": {"dfnID":"roaming-credential","dfnText":"roaming\ncredential","external":false,"refSections":[{"refs":[{"id":"ref-for-roaming-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-roaming-credential\u2460"}],"title":"13.4.6. Credential Loss and Key Mobility"}],"url":"#roaming-credential"},
-"rp-id": {"dfnID":"rp-id","dfnText":"RP ID","external":false,"refSections":[{"refs":[{"id":"ref-for-rp-id"},{"id":"ref-for-rp-id\u2460"},{"id":"ref-for-rp-id\u2461"},{"id":"ref-for-rp-id\u2462"},{"id":"ref-for-rp-id\u2463"},{"id":"ref-for-rp-id\u2464"},{"id":"ref-for-rp-id\u2465"},{"id":"ref-for-rp-id\u2466"},{"id":"ref-for-rp-id\u2467"},{"id":"ref-for-rp-id\u2468"},{"id":"ref-for-rp-id\u2460\u24ea"},{"id":"ref-for-rp-id\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-rp-id\u2460\u2461"},{"id":"ref-for-rp-id\u2460\u2462"},{"id":"ref-for-rp-id\u2460\u2463"},{"id":"ref-for-rp-id\u2460\u2464"},{"id":"ref-for-rp-id\u2460\u2465"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-rp-id\u2460\u2466"},{"id":"ref-for-rp-id\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-rp-id\u2460\u2468"},{"id":"ref-for-rp-id\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-rp-id\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-rp-id\u2461\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2462"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2463"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2464"},{"id":"ref-for-rp-id\u2461\u2465"},{"id":"ref-for-rp-id\u2461\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2467"},{"id":"ref-for-rp-id\u2461\u2468"},{"id":"ref-for-rp-id\u2462\u24ea"},{"id":"ref-for-rp-id\u2462\u2460"},{"id":"ref-for-rp-id\u2462\u2461"},{"id":"ref-for-rp-id\u2462\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-rp-id\u2462\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-rp-id\u2462\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-rp-id\u2462\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-rp-id\u2462\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-rp-id\u2462\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-rp-id\u2462\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-rp-id\u2463\u24ea"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-rp-id\u2463\u2460"},{"id":"ref-for-rp-id\u2463\u2461"},{"id":"ref-for-rp-id\u2463\u2462"},{"id":"ref-for-rp-id\u2463\u2463"},{"id":"ref-for-rp-id\u2463\u2464"},{"id":"ref-for-rp-id\u2463\u2465"},{"id":"ref-for-rp-id\u2463\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-rp-id\u2463\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-rp-id\u2463\u2468"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-rp-id\u2464\u24ea"},{"id":"ref-for-rp-id\u2464\u2460"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-rp-id\u2464\u2461"},{"id":"ref-for-rp-id\u2464\u2462"},{"id":"ref-for-rp-id\u2464\u2463"},{"id":"ref-for-rp-id\u2464\u2464"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#rp-id"},
+"rp-id": {"dfnID":"rp-id","dfnText":"RP ID","external":false,"refSections":[{"refs":[{"id":"ref-for-rp-id"},{"id":"ref-for-rp-id\u2460"},{"id":"ref-for-rp-id\u2461"},{"id":"ref-for-rp-id\u2462"},{"id":"ref-for-rp-id\u2463"},{"id":"ref-for-rp-id\u2464"},{"id":"ref-for-rp-id\u2465"},{"id":"ref-for-rp-id\u2466"},{"id":"ref-for-rp-id\u2467"},{"id":"ref-for-rp-id\u2468"},{"id":"ref-for-rp-id\u2460\u24ea"},{"id":"ref-for-rp-id\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-rp-id\u2460\u2461"},{"id":"ref-for-rp-id\u2460\u2462"},{"id":"ref-for-rp-id\u2460\u2463"},{"id":"ref-for-rp-id\u2460\u2464"},{"id":"ref-for-rp-id\u2460\u2465"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-rp-id\u2460\u2466"},{"id":"ref-for-rp-id\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-rp-id\u2460\u2468"},{"id":"ref-for-rp-id\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-rp-id\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-rp-id\u2461\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-rp-id\u2461\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2463"},{"id":"ref-for-rp-id\u2461\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2465"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2466"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-rp-id\u2461\u2467"},{"id":"ref-for-rp-id\u2461\u2468"},{"id":"ref-for-rp-id\u2462\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-rp-id\u2462\u2460"},{"id":"ref-for-rp-id\u2462\u2461"},{"id":"ref-for-rp-id\u2462\u2462"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-rp-id\u2462\u2463"},{"id":"ref-for-rp-id\u2462\u2464"},{"id":"ref-for-rp-id\u2462\u2465"},{"id":"ref-for-rp-id\u2462\u2466"},{"id":"ref-for-rp-id\u2462\u2467"},{"id":"ref-for-rp-id\u2462\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-rp-id\u2463\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-rp-id\u2463\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-rp-id\u2463\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-rp-id\u2463\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-rp-id\u2463\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-rp-id\u2463\u2464"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-rp-id\u2463\u2465"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-rp-id\u2463\u2466"},{"id":"ref-for-rp-id\u2463\u2467"},{"id":"ref-for-rp-id\u2463\u2468"},{"id":"ref-for-rp-id\u2464\u24ea"},{"id":"ref-for-rp-id\u2464\u2460"},{"id":"ref-for-rp-id\u2464\u2461"},{"id":"ref-for-rp-id\u2464\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-rp-id\u2464\u2463"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-rp-id\u2464\u2464"},{"id":"ref-for-rp-id\u2464\u2465"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-rp-id\u2464\u2466"},{"id":"ref-for-rp-id\u2464\u2467"},{"id":"ref-for-rp-id\u2464\u2468"},{"id":"ref-for-rp-id\u2465\u24ea"},{"id":"ref-for-rp-id\u2465\u2460"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-rp-id\u2465\u2461"}],"title":"16. Test Vectors"}],"url":"#rp-id"},
 "scope": {"dfnID":"scope","dfnText":"scope","external":false,"refSections":[{"refs":[{"id":"ref-for-scope\u2461"},{"id":"ref-for-scope\u2462"},{"id":"ref-for-scope\u2463"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-scope\u2464"},{"id":"ref-for-scope\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-scope\u2466"},{"id":"ref-for-scope\u2467"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-scope\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-scope\u2460\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-scope\u2460\u2460"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-scope\u2460\u2461"},{"id":"ref-for-scope\u2460\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-scope\u2460\u2463"},{"id":"ref-for-scope\u2460\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-scope\u2460\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-scope\u2460\u2466"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-scope\u2460\u2467"},{"id":"ref-for-scope\u2460\u2468"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-scope\u2461\u24ea"},{"id":"ref-for-scope\u2461\u2460"},{"id":"ref-for-scope\u2461\u2461"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-scope\u2461\u2462"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-scope\u2461\u2463"},{"id":"ref-for-scope\u2461\u2464"},{"id":"ref-for-scope\u2461\u2465"},{"id":"ref-for-scope\u2461\u2466"},{"id":"ref-for-scope\u2461\u2467"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-scope\u2461\u2468"},{"id":"ref-for-scope\u2462\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-scope\u2462\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#scope"},
 "second-factor-platform-authenticator": {"dfnID":"second-factor-platform-authenticator","dfnText":"Second-factor platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-second-factor-platform-authenticator"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#second-factor-platform-authenticator"},
 "second-factor-roaming-authenticator": {"dfnID":"second-factor-roaming-authenticator","dfnText":"Second-factor roaming authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-second-factor-roaming-authenticator"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#second-factor-roaming-authenticator"},
 "self": {"dfnID":"self","dfnText":"Self","external":false,"refSections":[{"refs":[{"id":"ref-for-self"},{"id":"ref-for-self\u2460"}],"title":"8.2. Packed Attestation Statement Format"}],"url":"#self"},
-"self-attestation": {"dfnID":"self-attestation","dfnText":"Self Attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-self-attestation"},{"id":"ref-for-self-attestation\u2460"},{"id":"ref-for-self-attestation\u2461"},{"id":"ref-for-self-attestation\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-self-attestation\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-self-attestation\u2464"},{"id":"ref-for-self-attestation\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-self-attestation\u2466"},{"id":"ref-for-self-attestation\u2467"},{"id":"ref-for-self-attestation\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-self-attestation\u2460\u24ea"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2460"},{"id":"ref-for-self-attestation\u2460\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2462"},{"id":"ref-for-self-attestation\u2460\u2463"},{"id":"ref-for-self-attestation\u2460\u2464"},{"id":"ref-for-self-attestation\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2466"},{"id":"ref-for-self-attestation\u2460\u2467"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-self-attestation\u2461\u24ea"}],"title":"13.4.5. Revoked Attestation Certificates"}],"url":"#self-attestation"},
+"self-attestation": {"dfnID":"self-attestation","dfnText":"Self Attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-self-attestation"},{"id":"ref-for-self-attestation\u2460"},{"id":"ref-for-self-attestation\u2461"},{"id":"ref-for-self-attestation\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-self-attestation\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-self-attestation\u2464"},{"id":"ref-for-self-attestation\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-self-attestation\u2466"},{"id":"ref-for-self-attestation\u2467"},{"id":"ref-for-self-attestation\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-self-attestation\u2460\u24ea"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2460"},{"id":"ref-for-self-attestation\u2460\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2462"},{"id":"ref-for-self-attestation\u2460\u2463"},{"id":"ref-for-self-attestation\u2460\u2464"},{"id":"ref-for-self-attestation\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2466"},{"id":"ref-for-self-attestation\u2460\u2467"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-self-attestation\u2460\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-self-attestation\u2461\u24ea"}],"title":"13.4.5. Revoked Attestation Certificates"}],"url":"#self-attestation"},
 "server-side-credential": {"dfnID":"server-side-credential","dfnText":"Server-side Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-server-side-credential"},{"id":"ref-for-server-side-credential\u2460"},{"id":"ref-for-server-side-credential\u2461"},{"id":"ref-for-server-side-credential\u2462"},{"id":"ref-for-server-side-credential\u2463"},{"id":"ref-for-server-side-credential\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-server-side-credential\u2465"},{"id":"ref-for-server-side-credential\u2466"},{"id":"ref-for-server-side-credential\u2467"},{"id":"ref-for-server-side-credential\u2468"},{"id":"ref-for-server-side-credential\u2460\u24ea"},{"id":"ref-for-server-side-credential\u2460\u2460"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-server-side-credential\u2460\u2461"},{"id":"ref-for-server-side-credential\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-server-side-credential\u2460\u2463"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-server-side-credential\u2460\u2464"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-server-side-credential\u2460\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#server-side-credential"},
 "server-side-credential-storage-modality": {"dfnID":"server-side-credential-storage-modality","dfnText":"server-side credential storage modality","external":false,"refSections":[{"refs":[{"id":"ref-for-server-side-credential-storage-modality"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-server-side-credential-storage-modality\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#server-side-credential-storage-modality"},
 "server-side-public-key-credential-source": {"dfnID":"server-side-public-key-credential-source","dfnText":"Server-side Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-server-side-public-key-credential-source"},{"id":"ref-for-server-side-public-key-credential-source\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-server-side-public-key-credential-source\u2461"}],"title":"11.5. Add Credential"}],"url":"#server-side-public-key-credential-source"},
 "set-credential-properties": {"dfnID":"set-credential-properties","dfnText":"Set Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-set-credential-properties"},{"id":"ref-for-set-credential-properties\u2460"}],"title":"11.10. Set Credential Properties"}],"url":"#set-credential-properties"},
 "set-credential-properties-parameters": {"dfnID":"set-credential-properties-parameters","dfnText":"Set Credential Properties Parameters","external":false,"refSections":[{"refs":[{"id":"ref-for-set-credential-properties-parameters"}],"title":"11.10. Set Credential Properties"}],"url":"#set-credential-properties-parameters"},
 "set-user-verified": {"dfnID":"set-user-verified","dfnText":"Set User Verified","external":false,"refSections":[{"refs":[{"id":"ref-for-set-user-verified"}],"title":"11.9. Set User Verified"}],"url":"#set-user-verified"},
+"signal-method-authenticator-action-unknowncredentialid": {"dfnID":"signal-method-authenticator-action-unknowncredentialid","dfnText":"unknownCredentialId","external":false,"refSections":[{"refs":[{"id":"ref-for-signal-method-authenticator-action-unknowncredentialid"}],"title":"5.1.10.2. signalUnknownCredential(options)"}],"url":"#signal-method-authenticator-action-unknowncredentialid"},
+"signal-method-authenticator-actions": {"dfnID":"signal-method-authenticator-actions","dfnText":"authenticator\nactions","external":false,"refSections":[{"refs":[{"id":"ref-for-signal-method-authenticator-actions"},{"id":"ref-for-signal-method-authenticator-actions\u2460"},{"id":"ref-for-signal-method-authenticator-actions\u2461"},{"id":"ref-for-signal-method-authenticator-actions\u2462"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-signal-method-authenticator-actions\u2463"},{"id":"ref-for-signal-method-authenticator-actions\u2464"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-signal-method-authenticator-actions\u2465"},{"id":"ref-for-signal-method-authenticator-actions\u2466"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-signal-method-authenticator-actions\u2467"},{"id":"ref-for-signal-method-authenticator-actions\u2468"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#signal-method-authenticator-actions"},
+"signal-method-authenticator-actions-allacceptedcredentialids": {"dfnID":"signal-method-authenticator-actions-allacceptedcredentialids","dfnText":"allAcceptedCredentialIds","external":false,"refSections":[{"refs":[{"id":"ref-for-signal-method-authenticator-actions-allacceptedcredentialids"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"}],"url":"#signal-method-authenticator-actions-allacceptedcredentialids"},
+"signal-method-authenticator-actions-currentuserdetails": {"dfnID":"signal-method-authenticator-actions-currentuserdetails","dfnText":"currentUserDetails","external":false,"refSections":[{"refs":[{"id":"ref-for-signal-method-authenticator-actions-currentuserdetails"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#signal-method-authenticator-actions-currentuserdetails"},
+"signal-methods": {"dfnID":"signal-methods","dfnText":"signal methods","external":false,"refSections":[{"refs":[{"id":"ref-for-signal-methods"},{"id":"ref-for-signal-methods\u2460"},{"id":"ref-for-signal-methods\u2461"},{"id":"ref-for-signal-methods\u2462"},{"id":"ref-for-signal-methods\u2463"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-signal-methods\u2464"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-signal-methods\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#signal-methods"},
 "signature-counter": {"dfnID":"signature-counter","dfnText":"Signature Counter","external":false,"refSections":[{"refs":[{"id":"ref-for-signature-counter"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-signature-counter\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-signature-counter\u2461"},{"id":"ref-for-signature-counter\u2462"},{"id":"ref-for-signature-counter\u2463"},{"id":"ref-for-signature-counter\u2464"},{"id":"ref-for-signature-counter\u2465"},{"id":"ref-for-signature-counter\u2466"},{"id":"ref-for-signature-counter\u2467"},{"id":"ref-for-signature-counter\u2468"},{"id":"ref-for-signature-counter\u2460\u24ea"},{"id":"ref-for-signature-counter\u2460\u2460"},{"id":"ref-for-signature-counter\u2460\u2461"},{"id":"ref-for-signature-counter\u2460\u2462"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-signature-counter\u2460\u2463"},{"id":"ref-for-signature-counter\u2460\u2464"},{"id":"ref-for-signature-counter\u2460\u2465"},{"id":"ref-for-signature-counter\u2460\u2466"},{"id":"ref-for-signature-counter\u2460\u2467"},{"id":"ref-for-signature-counter\u2460\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-signature-counter\u2461\u24ea"},{"id":"ref-for-signature-counter\u2461\u2460"},{"id":"ref-for-signature-counter\u2461\u2461"},{"id":"ref-for-signature-counter\u2461\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-signature-counter\u2461\u2463"},{"id":"ref-for-signature-counter\u2461\u2464"}],"title":"11.5. Add Credential"}],"url":"#signature-counter"},
 "signing-procedure": {"dfnID":"signing-procedure","dfnText":"Signing procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-signing-procedure"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-signing-procedure"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-signing-procedure\u2460"}],"title":"6.5.4. Generating an Attestation Object"}],"url":"#signing-procedure"},
-"silentcredentialdiscovery": {"dfnID":"silentcredentialdiscovery","dfnText":"silentCredentialDiscovery","external":false,"refSections":[{"refs":[{"id":"ref-for-silentcredentialdiscovery"},{"id":"ref-for-silentcredentialdiscovery\u2460"},{"id":"ref-for-silentcredentialdiscovery\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#silentcredentialdiscovery"},
+"silentcredentialdiscovery": {"dfnID":"silentcredentialdiscovery","dfnText":"silentCredentialDiscovery","external":false,"refSections":[{"refs":[{"id":"ref-for-silentcredentialdiscovery"},{"id":"ref-for-silentcredentialdiscovery\u2460"},{"id":"ref-for-silentcredentialdiscovery\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#silentcredentialdiscovery"},
 "single-device-credential": {"dfnID":"single-device-credential","dfnText":"single-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-single-device-credential"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-single-device-credential\u2460"},{"id":"ref-for-single-device-credential\u2461"},{"id":"ref-for-single-device-credential\u2462"}],"title":"6.1.3. Credential Backup State"}],"url":"#single-device-credential"},
 "single-factor-capable": {"dfnID":"single-factor-capable","dfnText":"single-factor capable","external":false,"refSections":[{"refs":[{"id":"ref-for-single-factor-capable"},{"id":"ref-for-single-factor-capable\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#single-factor-capable"},
-"supplemental-public-key": {"dfnID":"supplemental-public-key","dfnText":"Supplemental public key","external":false,"refSections":[{"refs":[{"id":"ref-for-supplemental-public-key"},{"id":"ref-for-supplemental-public-key\u2460"},{"id":"ref-for-supplemental-public-key\u2461"},{"id":"ref-for-supplemental-public-key\u2462"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-supplemental-public-key\u2463"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-supplemental-public-key\u2464"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-supplemental-public-key\u2465"},{"id":"ref-for-supplemental-public-key\u2466"},{"id":"ref-for-supplemental-public-key\u2467"},{"id":"ref-for-supplemental-public-key\u2468"},{"id":"ref-for-supplemental-public-key\u2460\u24ea"},{"id":"ref-for-supplemental-public-key\u2460\u2460"},{"id":"ref-for-supplemental-public-key\u2460\u2461"},{"id":"ref-for-supplemental-public-key\u2460\u2462"},{"id":"ref-for-supplemental-public-key\u2460\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#supplemental-public-key"},
-"supplementalpubkeys": {"dfnID":"supplementalpubkeys","dfnText":"supplementalPubKeys","external":false,"refSections":[{"refs":[{"id":"ref-for-supplementalpubkeys"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-supplementalpubkeys\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-supplementalpubkeys\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-supplementalpubkeys\u2462"},{"id":"ref-for-supplementalpubkeys\u2463"},{"id":"ref-for-supplementalpubkeys\u2464"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-supplementalpubkeys\u2465"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-supplementalpubkeys\u2466"},{"id":"ref-for-supplementalpubkeys\u2467"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"#supplementalpubkeys"},
 "test-of-user-presence": {"dfnID":"test-of-user-presence","dfnText":"Test of User Presence","external":false,"refSections":[{"refs":[{"id":"ref-for-test-of-user-presence"},{"id":"ref-for-test-of-user-presence\u2460"},{"id":"ref-for-test-of-user-presence\u2461"},{"id":"ref-for-test-of-user-presence\u2462"},{"id":"ref-for-test-of-user-presence\u2463"},{"id":"ref-for-test-of-user-presence\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-test-of-user-presence\u2465"},{"id":"ref-for-test-of-user-presence\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-test-of-user-presence\u2467"},{"id":"ref-for-test-of-user-presence\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-test-of-user-presence\u2460\u24ea"},{"id":"ref-for-test-of-user-presence\u2460\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-test-of-user-presence\u2460\u2461"}],"title":"11.2. Virtual Authenticators"}],"url":"#test-of-user-presence"},
-"typedefdef-base64urlstring": {"dfnID":"typedefdef-base64urlstring","dfnText":"Base64URLString","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-base64urlstring"},{"id":"ref-for-typedefdef-base64urlstring\u2460"},{"id":"ref-for-typedefdef-base64urlstring\u2461"},{"id":"ref-for-typedefdef-base64urlstring\u2462"},{"id":"ref-for-typedefdef-base64urlstring\u2463"},{"id":"ref-for-typedefdef-base64urlstring\u2464"},{"id":"ref-for-typedefdef-base64urlstring\u2465"},{"id":"ref-for-typedefdef-base64urlstring\u2466"},{"id":"ref-for-typedefdef-base64urlstring\u2467"},{"id":"ref-for-typedefdef-base64urlstring\u2468"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u24ea"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-typedefdef-base64urlstring\u2460\u2461"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2462"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2463"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-typedefdef-base64urlstring\u2460\u2464"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#typedefdef-base64urlstring"},
-"typedefdef-cosealgorithmidentifier": {"dfnID":"typedefdef-cosealgorithmidentifier","dfnText":"COSEAlgorithmIdentifier","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2461"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2463"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2464"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2465"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2466"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2468"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u24ea"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2461"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2462"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2463"}],"title":"8.3. TPM Attestation Statement Format"}],"url":"#typedefdef-cosealgorithmidentifier"},
+"typedefdef-base64urlstring": {"dfnID":"typedefdef-base64urlstring","dfnText":"Base64URLString","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-base64urlstring"},{"id":"ref-for-typedefdef-base64urlstring\u2460"},{"id":"ref-for-typedefdef-base64urlstring\u2461"},{"id":"ref-for-typedefdef-base64urlstring\u2462"},{"id":"ref-for-typedefdef-base64urlstring\u2463"},{"id":"ref-for-typedefdef-base64urlstring\u2464"},{"id":"ref-for-typedefdef-base64urlstring\u2465"},{"id":"ref-for-typedefdef-base64urlstring\u2466"},{"id":"ref-for-typedefdef-base64urlstring\u2467"},{"id":"ref-for-typedefdef-base64urlstring\u2468"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-typedefdef-base64urlstring\u2460\u24ea"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2460"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-typedefdef-base64urlstring\u2460\u2462"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-typedefdef-base64urlstring\u2460\u2463"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2464"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2465"},{"id":"ref-for-typedefdef-base64urlstring\u2460\u2466"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"}],"url":"#typedefdef-base64urlstring"},
+"typedefdef-cosealgorithmidentifier": {"dfnID":"typedefdef-cosealgorithmidentifier","dfnText":"COSEAlgorithmIdentifier","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2462"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2464"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2465"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2466"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2467"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u24ea"},{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2460"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-typedefdef-cosealgorithmidentifier\u2460\u2464"}],"title":"8.3. TPM Attestation Statement Format"}],"url":"#typedefdef-cosealgorithmidentifier"},
 "typedefdef-publickeycredentialclientcapabilities": {"dfnID":"typedefdef-publickeycredentialclientcapabilities","dfnText":"PublicKeyCredentialClientCapabilities","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-publickeycredentialclientcapabilities"},{"id":"ref-for-typedefdef-publickeycredentialclientcapabilities\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"#typedefdef-publickeycredentialclientcapabilities"},
 "typedefdef-publickeycredentialjson": {"dfnID":"typedefdef-publickeycredentialjson","dfnText":"PublicKeyCredentialJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-publickeycredentialjson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#typedefdef-publickeycredentialjson"},
-"typedefdef-uvmentries": {"dfnID":"typedefdef-uvmentries","dfnText":"UvmEntries","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-uvmentries"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-typedefdef-uvmentries\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-typedefdef-uvmentries\u2461"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#typedefdef-uvmentries"},
-"typedefdef-uvmentry": {"dfnID":"typedefdef-uvmentry","dfnText":"UvmEntry","external":false,"refSections":[{"refs":[{"id":"ref-for-typedefdef-uvmentry"}],"title":"10.2.1. User Verification Method Extension (uvm)"}],"url":"#typedefdef-uvmentry"},
 "ui-redressing": {"dfnID":"ui-redressing","dfnText":"UI Redressing","external":false,"refSections":[{"refs":[{"id":"ref-for-ui-redressing"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-ui-redressing\u2460"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"}],"url":"#ui-redressing"},
-"unsigned-extension-outputs": {"dfnID":"unsigned-extension-outputs","dfnText":"Unsigned extension outputs","external":false,"refSections":[{"refs":[{"id":"ref-for-unsigned-extension-outputs"},{"id":"ref-for-unsigned-extension-outputs\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2462"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2463"},{"id":"ref-for-unsigned-extension-outputs\u2464"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2465"},{"id":"ref-for-unsigned-extension-outputs\u2466"}],"title":"10.2.2.2. Extension Definition"}],"url":"#unsigned-extension-outputs"},
-"user-account": {"dfnID":"user-account","dfnText":"User Account","external":false,"refSections":[{"refs":[{"id":"ref-for-user-account"},{"id":"ref-for-user-account\u2460"},{"id":"ref-for-user-account\u2461"},{"id":"ref-for-user-account\u2462"},{"id":"ref-for-user-account\u2463"},{"id":"ref-for-user-account\u2464"},{"id":"ref-for-user-account\u2465"},{"id":"ref-for-user-account\u2466"},{"id":"ref-for-user-account\u2467"},{"id":"ref-for-user-account\u2468"},{"id":"ref-for-user-account\u2460\u24ea"},{"id":"ref-for-user-account\u2460\u2460"},{"id":"ref-for-user-account\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-account\u2460\u2462"},{"id":"ref-for-user-account\u2460\u2463"},{"id":"ref-for-user-account\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-user-account\u2460\u2465"},{"id":"ref-for-user-account\u2460\u2466"},{"id":"ref-for-user-account\u2460\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-user-account\u2460\u2468"},{"id":"ref-for-user-account\u2461\u24ea"},{"id":"ref-for-user-account\u2461\u2460"},{"id":"ref-for-user-account\u2461\u2461"},{"id":"ref-for-user-account\u2461\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-account\u2461\u2463"},{"id":"ref-for-user-account\u2461\u2464"},{"id":"ref-for-user-account\u2461\u2465"},{"id":"ref-for-user-account\u2461\u2466"},{"id":"ref-for-user-account\u2461\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-account\u2461\u2468"},{"id":"ref-for-user-account\u2462\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-user-account\u2462\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-account\u2462\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-account\u2462\u2462"},{"id":"ref-for-user-account\u2462\u2463"},{"id":"ref-for-user-account\u2462\u2464"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-account\u2462\u2465"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-user-account\u2462\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-user-account\u2462\u2467"},{"id":"ref-for-user-account\u2462\u2468"},{"id":"ref-for-user-account\u2463\u24ea"},{"id":"ref-for-user-account\u2463\u2460"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-user-account\u2463\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-account\u2463\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-account\u2463\u2463"},{"id":"ref-for-user-account\u2463\u2464"}],"title":"14.6.2. Username Enumeration"}],"url":"#user-account"},
-"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"},{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2462"},{"id":"ref-for-user-consent\u2460\u2463"},{"id":"ref-for-user-consent\u2460\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2465"},{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"},{"id":"ref-for-user-consent\u2460\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u24ea"},{"id":"ref-for-user-consent\u2461\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2461"},{"id":"ref-for-user-consent\u2461\u2462"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2463"},{"id":"ref-for-user-consent\u2461\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"},{"id":"ref-for-user-consent\u2461\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2461\u2468"},{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
-"user-credential": {"dfnID":"user-credential","dfnText":"User Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-user-credential"},{"id":"ref-for-user-credential\u2460"},{"id":"ref-for-user-credential\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-credential\u2462"},{"id":"ref-for-user-credential\u2463"},{"id":"ref-for-user-credential\u2464"},{"id":"ref-for-user-credential\u2465"},{"id":"ref-for-user-credential\u2466"},{"id":"ref-for-user-credential\u2467"},{"id":"ref-for-user-credential\u2468"},{"id":"ref-for-user-credential\u2460\u24ea"},{"id":"ref-for-user-credential\u2460\u2460"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-user-credential\u2460\u2461"},{"id":"ref-for-user-credential\u2460\u2462"},{"id":"ref-for-user-credential\u2460\u2463"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-user-credential\u2460\u2464"},{"id":"ref-for-user-credential\u2460\u2465"},{"id":"ref-for-user-credential\u2460\u2466"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-user-credential\u2460\u2467"}],"title":"10.2.2.2.2. Attestation calculations"},{"refs":[{"id":"ref-for-user-credential\u2460\u2468"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-user-credential\u2461\u24ea"},{"id":"ref-for-user-credential\u2461\u2460"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#user-credential"},
-"user-handle": {"dfnID":"user-handle","dfnText":"User Handle","external":false,"refSections":[{"refs":[{"id":"ref-for-user-handle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-user-handle\u2460"},{"id":"ref-for-user-handle\u2461"},{"id":"ref-for-user-handle\u2462"},{"id":"ref-for-user-handle\u2463"},{"id":"ref-for-user-handle\u2464"},{"id":"ref-for-user-handle\u2465"},{"id":"ref-for-user-handle\u2466"},{"id":"ref-for-user-handle\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-handle\u2468"},{"id":"ref-for-user-handle\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-handle\u2460\u2460"},{"id":"ref-for-user-handle\u2460\u2461"},{"id":"ref-for-user-handle\u2460\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-handle\u2460\u2463"},{"id":"ref-for-user-handle\u2460\u2464"},{"id":"ref-for-user-handle\u2460\u2465"},{"id":"ref-for-user-handle\u2460\u2466"},{"id":"ref-for-user-handle\u2460\u2467"},{"id":"ref-for-user-handle\u2460\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-handle\u2461\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-handle\u2461\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-handle\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-handle\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-handle\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-handle\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-handle\u2461\u2467"},{"id":"ref-for-user-handle\u2461\u2468"},{"id":"ref-for-user-handle\u2462\u24ea"},{"id":"ref-for-user-handle\u2462\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"#user-handle"},
+"unsigned-extension-outputs": {"dfnID":"unsigned-extension-outputs","dfnText":"Unsigned extension outputs","external":false,"refSections":[{"refs":[{"id":"ref-for-unsigned-extension-outputs"},{"id":"ref-for-unsigned-extension-outputs\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2462"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2463"},{"id":"ref-for-unsigned-extension-outputs\u2464"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#unsigned-extension-outputs"},
+"user-account": {"dfnID":"user-account","dfnText":"User Account","external":false,"refSections":[{"refs":[{"id":"ref-for-user-account"},{"id":"ref-for-user-account\u2460"},{"id":"ref-for-user-account\u2461"},{"id":"ref-for-user-account\u2462"},{"id":"ref-for-user-account\u2463"},{"id":"ref-for-user-account\u2464"},{"id":"ref-for-user-account\u2465"},{"id":"ref-for-user-account\u2466"},{"id":"ref-for-user-account\u2467"},{"id":"ref-for-user-account\u2468"},{"id":"ref-for-user-account\u2460\u24ea"},{"id":"ref-for-user-account\u2460\u2460"},{"id":"ref-for-user-account\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-account\u2460\u2462"},{"id":"ref-for-user-account\u2460\u2463"},{"id":"ref-for-user-account\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-user-account\u2460\u2465"},{"id":"ref-for-user-account\u2460\u2466"},{"id":"ref-for-user-account\u2460\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-user-account\u2460\u2468"},{"id":"ref-for-user-account\u2461\u24ea"},{"id":"ref-for-user-account\u2461\u2460"},{"id":"ref-for-user-account\u2461\u2461"},{"id":"ref-for-user-account\u2461\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-account\u2461\u2463"},{"id":"ref-for-user-account\u2461\u2464"},{"id":"ref-for-user-account\u2461\u2465"},{"id":"ref-for-user-account\u2461\u2466"},{"id":"ref-for-user-account\u2461\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-account\u2461\u2468"},{"id":"ref-for-user-account\u2462\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-user-account\u2462\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-account\u2462\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-account\u2462\u2462"},{"id":"ref-for-user-account\u2462\u2463"},{"id":"ref-for-user-account\u2462\u2464"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-account\u2462\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-user-account\u2462\u2466"},{"id":"ref-for-user-account\u2462\u2467"},{"id":"ref-for-user-account\u2462\u2468"},{"id":"ref-for-user-account\u2463\u24ea"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-user-account\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-account\u2463\u2461"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-account\u2463\u2462"},{"id":"ref-for-user-account\u2463\u2463"}],"title":"14.6.2. Username Enumeration"}],"url":"#user-account"},
+"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"},{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2463"},{"id":"ref-for-user-consent\u2460\u2464"},{"id":"ref-for-user-consent\u2460\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"},{"id":"ref-for-user-consent\u2460\u2468"},{"id":"ref-for-user-consent\u2461\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2460"},{"id":"ref-for-user-consent\u2461\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2462"},{"id":"ref-for-user-consent\u2461\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2464"},{"id":"ref-for-user-consent\u2461\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2461\u2467"},{"id":"ref-for-user-consent\u2461\u2468"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
+"user-handle": {"dfnID":"user-handle","dfnText":"User Handle","external":false,"refSections":[{"refs":[{"id":"ref-for-user-handle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-user-handle\u2460"},{"id":"ref-for-user-handle\u2461"},{"id":"ref-for-user-handle\u2462"},{"id":"ref-for-user-handle\u2463"},{"id":"ref-for-user-handle\u2464"},{"id":"ref-for-user-handle\u2465"},{"id":"ref-for-user-handle\u2466"},{"id":"ref-for-user-handle\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-handle\u2468"},{"id":"ref-for-user-handle\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-user-handle\u2460\u2460"},{"id":"ref-for-user-handle\u2460\u2461"},{"id":"ref-for-user-handle\u2460\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-handle\u2460\u2463"},{"id":"ref-for-user-handle\u2460\u2464"},{"id":"ref-for-user-handle\u2460\u2465"},{"id":"ref-for-user-handle\u2460\u2466"},{"id":"ref-for-user-handle\u2460\u2467"},{"id":"ref-for-user-handle\u2460\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-handle\u2461\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-handle\u2461\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-handle\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-handle\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-handle\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-handle\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-handle\u2461\u2467"},{"id":"ref-for-user-handle\u2461\u2468"},{"id":"ref-for-user-handle\u2462\u24ea"},{"id":"ref-for-user-handle\u2462\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"#user-handle"},
 "user-public-key": {"dfnID":"user-public-key","dfnText":"User Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-user-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-public-key\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#user-public-key"},
-"user-verification": {"dfnID":"user-verification","dfnText":"User Verification","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verification"},{"id":"ref-for-user-verification\u2460"},{"id":"ref-for-user-verification\u2461"},{"id":"ref-for-user-verification\u2462"},{"id":"ref-for-user-verification\u2463"},{"id":"ref-for-user-verification\u2464"},{"id":"ref-for-user-verification\u2465"},{"id":"ref-for-user-verification\u2466"},{"id":"ref-for-user-verification\u2467"},{"id":"ref-for-user-verification\u2468"},{"id":"ref-for-user-verification\u2460\u24ea"},{"id":"ref-for-user-verification\u2460\u2460"},{"id":"ref-for-user-verification\u2460\u2461"},{"id":"ref-for-user-verification\u2460\u2462"},{"id":"ref-for-user-verification\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-verification\u2460\u2464"},{"id":"ref-for-user-verification\u2460\u2465"},{"id":"ref-for-user-verification\u2460\u2466"},{"id":"ref-for-user-verification\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-verification\u2460\u2468"},{"id":"ref-for-user-verification\u2461\u24ea"},{"id":"ref-for-user-verification\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-verification\u2461\u2461"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2463"},{"id":"ref-for-user-verification\u2461\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2465"},{"id":"ref-for-user-verification\u2461\u2466"},{"id":"ref-for-user-verification\u2461\u2467"},{"id":"ref-for-user-verification\u2461\u2468"},{"id":"ref-for-user-verification\u2462\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2462\u2460"},{"id":"ref-for-user-verification\u2462\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-user-verification\u2462\u2462"},{"id":"ref-for-user-verification\u2462\u2463"},{"id":"ref-for-user-verification\u2462\u2464"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-verification\u2462\u2465"},{"id":"ref-for-user-verification\u2462\u2466"},{"id":"ref-for-user-verification\u2462\u2467"},{"id":"ref-for-user-verification\u2462\u2468"},{"id":"ref-for-user-verification\u2463\u24ea"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-user-verification\u2463\u2460"},{"id":"ref-for-user-verification\u2463\u2461"},{"id":"ref-for-user-verification\u2463\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-verification\u2463\u2465"},{"id":"ref-for-user-verification\u2463\u2466"},{"id":"ref-for-user-verification\u2463\u2467"},{"id":"ref-for-user-verification\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-verification\u2464\u24ea"},{"id":"ref-for-user-verification\u2464\u2460"},{"id":"ref-for-user-verification\u2464\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-user-verification\u2464\u2462"},{"id":"ref-for-user-verification\u2464\u2463"},{"id":"ref-for-user-verification\u2464\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2464\u2465"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-user-verification\u2464\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-verification\u2464\u2467"},{"id":"ref-for-user-verification\u2464\u2468"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-user-verification\u2465\u24ea"},{"id":"ref-for-user-verification\u2465\u2460"},{"id":"ref-for-user-verification\u2465\u2461"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2465\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-verification\u2465\u2463"}],"title":"15. Accessibility Considerations"}],"url":"#user-verification"},
-"user-verification-method": {"dfnID":"user-verification-method","dfnText":"User Verification Method","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verification-method"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-user-verification-method\u2460"},{"id":"ref-for-user-verification-method\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-verification-method\u2462"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#user-verification-method"},
+"user-verification": {"dfnID":"user-verification","dfnText":"User Verification","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verification"},{"id":"ref-for-user-verification\u2460"},{"id":"ref-for-user-verification\u2461"},{"id":"ref-for-user-verification\u2462"},{"id":"ref-for-user-verification\u2463"},{"id":"ref-for-user-verification\u2464"},{"id":"ref-for-user-verification\u2465"},{"id":"ref-for-user-verification\u2466"},{"id":"ref-for-user-verification\u2467"},{"id":"ref-for-user-verification\u2468"},{"id":"ref-for-user-verification\u2460\u24ea"},{"id":"ref-for-user-verification\u2460\u2460"},{"id":"ref-for-user-verification\u2460\u2461"},{"id":"ref-for-user-verification\u2460\u2462"},{"id":"ref-for-user-verification\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-verification\u2460\u2464"},{"id":"ref-for-user-verification\u2460\u2465"},{"id":"ref-for-user-verification\u2460\u2466"},{"id":"ref-for-user-verification\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-user-verification\u2460\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-verification\u2461\u24ea"},{"id":"ref-for-user-verification\u2461\u2460"},{"id":"ref-for-user-verification\u2461\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-verification\u2461\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2464"},{"id":"ref-for-user-verification\u2461\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2466"},{"id":"ref-for-user-verification\u2461\u2467"},{"id":"ref-for-user-verification\u2461\u2468"},{"id":"ref-for-user-verification\u2462\u24ea"},{"id":"ref-for-user-verification\u2462\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2462\u2461"},{"id":"ref-for-user-verification\u2462\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-user-verification\u2462\u2463"},{"id":"ref-for-user-verification\u2462\u2464"},{"id":"ref-for-user-verification\u2462\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-verification\u2462\u2466"},{"id":"ref-for-user-verification\u2462\u2467"},{"id":"ref-for-user-verification\u2462\u2468"},{"id":"ref-for-user-verification\u2463\u24ea"},{"id":"ref-for-user-verification\u2463\u2460"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-user-verification\u2463\u2461"},{"id":"ref-for-user-verification\u2463\u2462"},{"id":"ref-for-user-verification\u2463\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-verification\u2463\u2466"},{"id":"ref-for-user-verification\u2463\u2467"},{"id":"ref-for-user-verification\u2463\u2468"},{"id":"ref-for-user-verification\u2464\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-verification\u2464\u2460"},{"id":"ref-for-user-verification\u2464\u2461"},{"id":"ref-for-user-verification\u2464\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-user-verification\u2464\u2463"},{"id":"ref-for-user-verification\u2464\u2464"},{"id":"ref-for-user-verification\u2464\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2464\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-user-verification\u2464\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-verification\u2464\u2468"},{"id":"ref-for-user-verification\u2465\u24ea"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-user-verification\u2465\u2460"},{"id":"ref-for-user-verification\u2465\u2461"},{"id":"ref-for-user-verification\u2465\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2465\u2463"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-verification\u2465\u2464"}],"title":"15. Accessibility Considerations"}],"url":"#user-verification"},
 "user-verifying-platform-authenticator": {"dfnID":"user-verifying-platform-authenticator","dfnText":"User-verifying platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verifying-platform-authenticator"},{"id":"ref-for-user-verifying-platform-authenticator\u2460"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2461"},{"id":"ref-for-user-verifying-platform-authenticator\u2462"},{"id":"ref-for-user-verifying-platform-authenticator\u2463"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2465"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#user-verifying-platform-authenticator"},
-"verification-procedure": {"dfnID":"verification-procedure","dfnText":"Verification procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-verification-procedure"},{"id":"ref-for-verification-procedure\u2460"},{"id":"ref-for-verification-procedure\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-verification-procedure\u2462"},{"id":"ref-for-verification-procedure\u2463"},{"id":"ref-for-verification-procedure\u2464"},{"id":"ref-for-verification-procedure\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-verification-procedure\u2466"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u24ea"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2461"},{"id":"ref-for-verification-procedure\u2460\u2462"},{"id":"ref-for-verification-procedure\u2460\u2463"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2464"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2465"},{"id":"ref-for-verification-procedure\u2460\u2466"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#verification-procedure"},
+"verification-procedure": {"dfnID":"verification-procedure","dfnText":"Verification procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-verification-procedure"},{"id":"ref-for-verification-procedure\u2460"},{"id":"ref-for-verification-procedure\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-verification-procedure\u2462"},{"id":"ref-for-verification-procedure\u2463"},{"id":"ref-for-verification-procedure\u2464"},{"id":"ref-for-verification-procedure\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-verification-procedure\u2466"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u24ea"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2461"},{"id":"ref-for-verification-procedure\u2460\u2462"},{"id":"ref-for-verification-procedure\u2460\u2463"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#verification-procedure"},
 "verification-procedure-inputs": {"dfnID":"verification-procedure-inputs","dfnText":"verification procedure inputs","external":false,"refSections":[{"refs":[{"id":"ref-for-verification-procedure-inputs"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2460"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2461"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2462"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2463"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2464"},{"id":"ref-for-verification-procedure-inputs\u2465"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#verification-procedure-inputs"},
 "virtual-authenticator-database": {"dfnID":"virtual-authenticator-database","dfnText":"Virtual Authenticator Database","external":false,"refSections":[{"refs":[{"id":"ref-for-virtual-authenticator-database"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2460"},{"id":"ref-for-virtual-authenticator-database\u2461"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2463"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2464"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2465"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2466"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-virtual-authenticator-database\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"#virtual-authenticator-database"},
-"virtual-authenticators": {"dfnID":"virtual-authenticators","dfnText":"Virtual Authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-virtual-authenticators"},{"id":"ref-for-virtual-authenticators\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461"},{"id":"ref-for-virtual-authenticators\u2462"},{"id":"ref-for-virtual-authenticators\u2463"},{"id":"ref-for-virtual-authenticators\u2464"},{"id":"ref-for-virtual-authenticators\u2465"},{"id":"ref-for-virtual-authenticators\u2466"},{"id":"ref-for-virtual-authenticators\u2467"},{"id":"ref-for-virtual-authenticators\u2468"},{"id":"ref-for-virtual-authenticators\u2460\u24ea"},{"id":"ref-for-virtual-authenticators\u2460\u2460"},{"id":"ref-for-virtual-authenticators\u2460\u2461"},{"id":"ref-for-virtual-authenticators\u2460\u2462"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2463"},{"id":"ref-for-virtual-authenticators\u2460\u2464"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2465"},{"id":"ref-for-virtual-authenticators\u2460\u2466"},{"id":"ref-for-virtual-authenticators\u2460\u2467"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2468"},{"id":"ref-for-virtual-authenticators\u2461\u24ea"},{"id":"ref-for-virtual-authenticators\u2461\u2460"},{"id":"ref-for-virtual-authenticators\u2461\u2461"},{"id":"ref-for-virtual-authenticators\u2461\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2463"},{"id":"ref-for-virtual-authenticators\u2461\u2464"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2465"},{"id":"ref-for-virtual-authenticators\u2461\u2466"},{"id":"ref-for-virtual-authenticators\u2461\u2467"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2468"},{"id":"ref-for-virtual-authenticators\u2462\u24ea"},{"id":"ref-for-virtual-authenticators\u2462\u2460"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-virtual-authenticators\u2462\u2461"},{"id":"ref-for-virtual-authenticators\u2462\u2462"},{"id":"ref-for-virtual-authenticators\u2462\u2463"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-virtual-authenticators\u2462\u2464"},{"id":"ref-for-virtual-authenticators\u2462\u2465"}],"title":"11.10. Set Credential Properties"}],"url":"#virtual-authenticators"},
+"virtual-authenticators": {"dfnID":"virtual-authenticators","dfnText":"Virtual Authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-virtual-authenticators"},{"id":"ref-for-virtual-authenticators\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461"},{"id":"ref-for-virtual-authenticators\u2462"},{"id":"ref-for-virtual-authenticators\u2463"},{"id":"ref-for-virtual-authenticators\u2464"},{"id":"ref-for-virtual-authenticators\u2465"},{"id":"ref-for-virtual-authenticators\u2466"},{"id":"ref-for-virtual-authenticators\u2467"},{"id":"ref-for-virtual-authenticators\u2468"},{"id":"ref-for-virtual-authenticators\u2460\u24ea"},{"id":"ref-for-virtual-authenticators\u2460\u2460"},{"id":"ref-for-virtual-authenticators\u2460\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2462"},{"id":"ref-for-virtual-authenticators\u2460\u2463"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2464"},{"id":"ref-for-virtual-authenticators\u2460\u2465"},{"id":"ref-for-virtual-authenticators\u2460\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-virtual-authenticators\u2460\u2467"},{"id":"ref-for-virtual-authenticators\u2460\u2468"},{"id":"ref-for-virtual-authenticators\u2461\u24ea"},{"id":"ref-for-virtual-authenticators\u2461\u2460"},{"id":"ref-for-virtual-authenticators\u2461\u2461"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2462"},{"id":"ref-for-virtual-authenticators\u2461\u2463"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2464"},{"id":"ref-for-virtual-authenticators\u2461\u2465"},{"id":"ref-for-virtual-authenticators\u2461\u2466"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-virtual-authenticators\u2461\u2467"},{"id":"ref-for-virtual-authenticators\u2461\u2468"},{"id":"ref-for-virtual-authenticators\u2462\u24ea"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-virtual-authenticators\u2462\u2460"},{"id":"ref-for-virtual-authenticators\u2462\u2461"},{"id":"ref-for-virtual-authenticators\u2462\u2462"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-virtual-authenticators\u2462\u2463"},{"id":"ref-for-virtual-authenticators\u2462\u2464"}],"title":"11.10. Set Credential Properties"}],"url":"#virtual-authenticators"},
 "web-application": {"dfnID":"web-application","dfnText":"web application","external":false,"refSections":[{"refs":[{"id":"ref-for-web-application\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-application\u2461"},{"id":"ref-for-web-application\u2462"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-web-application\u2463"}],"title":"11. User Agent Automation"},{"refs":[{"id":"ref-for-web-application\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-web-application\u2465"}],"title":"13. Security Considerations"}],"url":"#web-application"},
-"web-authentication-api": {"dfnID":"web-authentication-api","dfnText":"Web Authentication API","external":false,"refSections":[{"refs":[{"id":"ref-for-web-authentication-api"},{"id":"ref-for-web-authentication-api\u2460"},{"id":"ref-for-web-authentication-api\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-authentication-api\u2462"},{"id":"ref-for-web-authentication-api\u2463"},{"id":"ref-for-web-authentication-api\u2464"},{"id":"ref-for-web-authentication-api\u2465"},{"id":"ref-for-web-authentication-api\u2466"},{"id":"ref-for-web-authentication-api\u2467"},{"id":"ref-for-web-authentication-api\u2468"},{"id":"ref-for-web-authentication-api\u2460\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2464"},{"id":"ref-for-web-authentication-api\u2460\u2465"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2467"},{"id":"ref-for-web-authentication-api\u2460\u2468"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#web-authentication-api"},
-"webauthn-authenticator": {"dfnID":"webauthn-authenticator","dfnText":"WebAuthn Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-authenticator"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461"},{"id":"ref-for-webauthn-authenticator\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2463"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2465"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2468"},{"id":"ref-for-webauthn-authenticator\u2460\u24ea"}],"title":"13.3.1. Attestation Certificate Hierarchy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2460"},{"id":"ref-for-webauthn-authenticator\u2460\u2461"},{"id":"ref-for-webauthn-authenticator\u2460\u2462"},{"id":"ref-for-webauthn-authenticator\u2460\u2463"},{"id":"ref-for-webauthn-authenticator\u2460\u2464"},{"id":"ref-for-webauthn-authenticator\u2460\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2466"},{"id":"ref-for-webauthn-authenticator\u2460\u2467"}],"title":"14.4.1. Attestation Privacy"}],"url":"#webauthn-authenticator"},
-"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2461"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2463"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
+"web-authentication-api": {"dfnID":"web-authentication-api","dfnText":"Web Authentication API","external":false,"refSections":[{"refs":[{"id":"ref-for-web-authentication-api"},{"id":"ref-for-web-authentication-api\u2460"},{"id":"ref-for-web-authentication-api\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-authentication-api\u2462"},{"id":"ref-for-web-authentication-api\u2463"},{"id":"ref-for-web-authentication-api\u2464"},{"id":"ref-for-web-authentication-api\u2465"},{"id":"ref-for-web-authentication-api\u2466"},{"id":"ref-for-web-authentication-api\u2467"},{"id":"ref-for-web-authentication-api\u2468"},{"id":"ref-for-web-authentication-api\u2460\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2464"},{"id":"ref-for-web-authentication-api\u2460\u2465"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2467"},{"id":"ref-for-web-authentication-api\u2460\u2468"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#web-authentication-api"},
+"webauthn-authenticator": {"dfnID":"webauthn-authenticator","dfnText":"WebAuthn Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-authenticator"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461"},{"id":"ref-for-webauthn-authenticator\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2463"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2465"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2466"},{"id":"ref-for-webauthn-authenticator\u2467"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2460"},{"id":"ref-for-webauthn-authenticator\u2460\u2461"}],"title":"13.3.1. Attestation Certificate Hierarchy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2462"},{"id":"ref-for-webauthn-authenticator\u2460\u2463"},{"id":"ref-for-webauthn-authenticator\u2460\u2464"},{"id":"ref-for-webauthn-authenticator\u2460\u2465"},{"id":"ref-for-webauthn-authenticator\u2460\u2466"},{"id":"ref-for-webauthn-authenticator\u2460\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2468"},{"id":"ref-for-webauthn-authenticator\u2461\u24ea"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461\u2460"}],"title":"16.2.1. Pseudo-random function extension (prf)"}],"url":"#webauthn-authenticator"},
+"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"},{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"},{"id":"ref-for-webauthn-client\u2460\u2466"},{"id":"ref-for-webauthn-client\u2460\u2467"},{"id":"ref-for-webauthn-client\u2460\u2468"},{"id":"ref-for-webauthn-client\u2461\u24ea"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2460"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2461"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2463"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2464"},{"id":"ref-for-webauthn-client\u2461\u2465"}],"title":"16.2.1. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2466"}],"title":"16.2.1.1. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2467"}],"title":"16.2.1.2. CTAP2 hmac-secret extension"}],"url":"#webauthn-client"},
 "webauthn-client-device": {"dfnID":"webauthn-client-device","dfnText":"WebAuthn Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client-device"},{"id":"ref-for-webauthn-client-device\u2460"}],"title":"4. Terminology"}],"url":"#webauthn-client-device"},
-"webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"},{"id":"ref-for-webauthn-extensions\u2468"},{"id":"ref-for-webauthn-extensions\u2460\u24ea"}],"title":"9. WebAuthn Extensions"}],"url":"#webauthn-extensions"},
+"webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2468"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2461"},{"id":"ref-for-webauthn-extensions\u2460\u2462"},{"id":"ref-for-webauthn-extensions\u2460\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2464"}],"title":"16. Test Vectors"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2465"},{"id":"ref-for-webauthn-extensions\u2460\u2466"}],"title":"16.2. Test Vectors for WebAuthn Extensions"}],"url":"#webauthn-extensions"},
 "webauthn-fido2-protocol": {"dfnID":"webauthn-fido2-protocol","dfnText":"WebAuthn/FIDO2 protocol","external":false,"refSections":[],"url":"#webauthn-fido2-protocol"},
-"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2463"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2468"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2460"},{"id":"ref-for-webauthn-relying-party\u2462\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2462"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"},{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"},{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"14.6.2. Username Enumeration"}],"url":"#webauthn-relying-party"},
+"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"},{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"},{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"},{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"},{"id":"ref-for-webauthn-relying-party\u2461\u2463"},{"id":"ref-for-webauthn-relying-party\u2461\u2464"},{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"},{"id":"ref-for-webauthn-relying-party\u2461\u2467"},{"id":"ref-for-webauthn-relying-party\u2461\u2468"},{"id":"ref-for-webauthn-relying-party\u2462\u24ea"},{"id":"ref-for-webauthn-relying-party\u2462\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2461"},{"id":"ref-for-webauthn-relying-party\u2462\u2462"},{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"},{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u24ea"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2460"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2461"},{"id":"ref-for-webauthn-relying-party\u2465\u2462"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2463"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2468"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u24ea"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2460"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2462"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2463"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2466"}],"title":"16. Test Vectors"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2467"}],"title":"16.2.1. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2468"}],"title":"16.2.1.1. Web Authentication API"}],"url":"#webauthn-relying-party"},
 "webauthn-signature": {"dfnID":"webauthn-signature","dfnText":"WebAuthn signature","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-signature"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-signature\u2460"}],"title":"6. WebAuthn Authenticator Model"}],"url":"#webauthn-signature"},
 };
 
@@ -12246,619 +12951,640 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "use strict";
 {
 let refsData = {
-"#aaguid": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"aaguid","type":"dfn","url":"#aaguid"},
-"#abstract-opdef-create-a-new-supplemental-public-key-record": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"Create a new supplemental public key record","type":"abstract-op","url":"#abstract-opdef-create-a-new-supplemental-public-key-record"},
-"#abstract-opdef-credential-record-attestationclientdatajson": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationClientDataJSON","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationclientdatajson"},
-"#abstract-opdef-credential-record-attestationobject": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationObject","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationobject"},
-"#abstract-opdef-credential-record-authenticatordisplayname": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorDisplayName","type":"abstract-op","url":"#abstract-opdef-credential-record-authenticatordisplayname"},
-"#abstract-opdef-credential-record-backupeligible": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupEligible","type":"abstract-op","url":"#abstract-opdef-credential-record-backupeligible"},
-"#abstract-opdef-credential-record-backupstate": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupState","type":"abstract-op","url":"#abstract-opdef-credential-record-backupstate"},
-"#abstract-opdef-credential-record-id": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"abstract-op","url":"#abstract-opdef-credential-record-id"},
-"#abstract-opdef-credential-record-publickey": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"abstract-op","url":"#abstract-opdef-credential-record-publickey"},
-"#abstract-opdef-credential-record-signcount": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signCount","type":"abstract-op","url":"#abstract-opdef-credential-record-signcount"},
-"#abstract-opdef-credential-record-supplementalpubkeys": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplementalPubKeys","type":"abstract-op","url":"#abstract-opdef-credential-record-supplementalpubkeys"},
-"#abstract-opdef-credential-record-transports": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"abstract-op","url":"#abstract-opdef-credential-record-transports"},
-"#abstract-opdef-credential-record-type": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"abstract-op","url":"#abstract-opdef-credential-record-type"},
-"#abstract-opdef-credential-record-uvinitialized": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"uvInitialized","type":"abstract-op","url":"#abstract-opdef-credential-record-uvinitialized"},
-"#abstract-opdef-supplementalpubkeys-record-aaguid": {"export":true,"for_":["supplementalPubKeys record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"aaguid","type":"abstract-op","url":"#abstract-opdef-supplementalpubkeys-record-aaguid"},
-"#abstract-opdef-supplementalpubkeys-record-attstmt": {"export":true,"for_":["supplementalPubKeys record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attStmt","type":"abstract-op","url":"#abstract-opdef-supplementalpubkeys-record-attstmt"},
-"#abstract-opdef-supplementalpubkeys-record-fmt": {"export":true,"for_":["supplementalPubKeys record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"fmt","type":"abstract-op","url":"#abstract-opdef-supplementalpubkeys-record-fmt"},
-"#abstract-opdef-supplementalpubkeys-record-scope": {"export":true,"for_":["supplementalPubKeys record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"scope","type":"abstract-op","url":"#abstract-opdef-supplementalpubkeys-record-scope"},
-"#abstract-opdef-supplementalpubkeys-record-spk": {"export":true,"for_":["supplementalPubKeys record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"spk","type":"abstract-op","url":"#abstract-opdef-supplementalpubkeys-record-spk"},
-"#add-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"add credential","type":"dfn","url":"#add-credential"},
-"#add-virtual-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"add virtual authenticator","type":"dfn","url":"#add-virtual-authenticator"},
-"#android-key-attestation-certificate-extension-data": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"android key attestation certificate extension data","type":"dfn","url":"#android-key-attestation-certificate-extension-data"},
-"#anonca": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"anonca","type":"dfn","url":"#anonca"},
-"#anonymization-ca": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"anonymization ca","type":"dfn","url":"#anonymization-ca"},
-"#appid": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appid","type":"dfn","url":"#appid"},
-"#assertion": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"assertion","type":"dfn","url":"#assertion"},
-"#assertion-signature": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"assertion signature","type":"dfn","url":"#assertion-signature"},
-"#assertioncreationdata-authenticatordataresult": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatordataresult","type":"dfn","url":"#assertioncreationdata-authenticatordataresult"},
-"#assertioncreationdata-clientdatajsonresult": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientdatajsonresult","type":"dfn","url":"#assertioncreationdata-clientdatajsonresult"},
-"#assertioncreationdata-clientextensionresults": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientextensionresults","type":"dfn","url":"#assertioncreationdata-clientextensionresults"},
-"#assertioncreationdata-credentialidresult": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialidresult","type":"dfn","url":"#assertioncreationdata-credentialidresult"},
-"#assertioncreationdata-signatureresult": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signatureresult","type":"dfn","url":"#assertioncreationdata-signatureresult"},
-"#assertioncreationdata-userhandleresult": {"export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userhandleresult","type":"dfn","url":"#assertioncreationdata-userhandleresult"},
-"#attca": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attca","type":"dfn","url":"#attca"},
-"#attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation","type":"dfn","url":"#attestation"},
-"#attestation-ca": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation ca","type":"dfn","url":"#attestation-ca"},
-"#attestation-certificate": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation certificate","type":"dfn","url":"#attestation-certificate"},
-"#attestation-conveyance": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation conveyance","type":"dfn","url":"#attestation-conveyance"},
-"#attestation-key-pair": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation key pair","type":"dfn","url":"#attestation-key-pair"},
-"#attestation-object": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation object","type":"dfn","url":"#attestation-object"},
-"#attestation-private-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation private key","type":"dfn","url":"#attestation-private-key"},
-"#attestation-public-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation public key","type":"dfn","url":"#attestation-public-key"},
-"#attestation-signature": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation signature","type":"dfn","url":"#attestation-signature"},
-"#attestation-statement": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement","type":"dfn","url":"#attestation-statement"},
-"#attestation-statement-format": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement format","type":"dfn","url":"#attestation-statement-format"},
-"#attestation-statement-format-identifier": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement format identifier","type":"dfn","url":"#attestation-statement-format-identifier"},
-"#attestation-trust-path": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation trust path","type":"dfn","url":"#attestation-trust-path"},
-"#attestation-type": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation type","type":"dfn","url":"#attestation-type"},
-"#attested-credential-data": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attested credential data","type":"dfn","url":"#attested-credential-data"},
-"#authdata-attestedcredentialdata": {"export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestedcredentialdata","type":"dfn","url":"#authdata-attestedcredentialdata"},
-"#authdata-attestedcredentialdata-aaguid": {"export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"aaguid","type":"dfn","url":"#authdata-attestedcredentialdata-aaguid"},
-"#authdata-attestedcredentialdata-credentialid": {"export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialid","type":"dfn","url":"#authdata-attestedcredentialdata-credentialid"},
-"#authdata-attestedcredentialdata-credentialidlength": {"export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialidlength","type":"dfn","url":"#authdata-attestedcredentialdata-credentialidlength"},
-"#authdata-attestedcredentialdata-credentialpublickey": {"export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialpublickey","type":"dfn","url":"#authdata-attestedcredentialdata-credentialpublickey"},
-"#authdata-extensions": {"export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dfn","url":"#authdata-extensions"},
-"#authdata-flags": {"export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"flags","type":"dfn","url":"#authdata-flags"},
-"#authdata-flags-at": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"at","type":"dfn","url":"#authdata-flags-at"},
-"#authdata-flags-be": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"be","type":"dfn","url":"#authdata-flags-be"},
-"#authdata-flags-bs": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"bs","type":"dfn","url":"#authdata-flags-bs"},
-"#authdata-flags-ed": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ed","type":"dfn","url":"#authdata-flags-ed"},
-"#authdata-flags-up": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"up","type":"dfn","url":"#authdata-flags-up"},
-"#authdata-flags-uv": {"export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"uv","type":"dfn","url":"#authdata-flags-uv"},
-"#authdata-rpidhash": {"export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpidhash","type":"dfn","url":"#authdata-rpidhash"},
-"#authdata-signcount": {"export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signcount","type":"dfn","url":"#authdata-signcount"},
-"#authentication": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication","type":"dfn","url":"#authentication"},
-"#authentication-assertion": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication assertion","type":"dfn","url":"#authentication-assertion"},
-"#authentication-ceremony": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication ceremony","type":"dfn","url":"#authentication-ceremony"},
-"#authentication-extension": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication extension","type":"dfn","url":"#authentication-extension"},
-"#authentication-factor-capability": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication factor capability","type":"dfn","url":"#authentication-factor-capability"},
-"#authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator","type":"dfn","url":"#authenticator"},
-"#authenticator-attachment-modality": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator attachment modality","type":"dfn","url":"#authenticator-attachment-modality"},
-"#authenticator-configuration": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator configuration","type":"dfn","url":"#authenticator-configuration"},
-"#authenticator-credentials-map": {"export":true,"for_":["authenticator"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentials map","type":"dfn","url":"#authenticator-credentials-map"},
-"#authenticator-data": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data","type":"dfn","url":"#authenticator-data"},
-"#authenticator-data-claimed-to-have-been-used-for-the-attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data claimed to have been used for the attestation","type":"dfn","url":"#authenticator-data-claimed-to-have-been-used-for-the-attestation"},
-"#authenticator-data-for-the-attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data for the attestation","type":"dfn","url":"#authenticator-data-for-the-attestation"},
-"#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure": {"export":true,"for_":["authenticator data"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"perform the following steps to generate an authenticator data structure","type":"dfn","url":"#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure"},
-"#authenticator-extension": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension","type":"dfn","url":"#authenticator-extension"},
-"#authenticator-extension-capabilities": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension capabilities","type":"dfn","url":"#authenticator-extension-capabilities"},
-"#authenticator-extension-input": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension input","type":"dfn","url":"#authenticator-extension-input"},
-"#authenticator-extension-output": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension output","type":"dfn","url":"#authenticator-extension-output"},
-"#authenticator-extension-processing": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension processing","type":"dfn","url":"#authenticator-extension-processing"},
-"#authenticator-model": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator model","type":"dfn","url":"#authenticator-model"},
-"#authenticator-operations": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator operations","type":"dfn","url":"#authenticator-operations"},
-"#authenticator-session": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator session","type":"dfn","url":"#authenticator-session"},
-"#authenticator-type": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator type","type":"dfn","url":"#authenticator-type"},
-"#authenticatorassertionresponse": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAssertionResponse","type":"interface","url":"#authenticatorassertionresponse"},
-"#authenticatorattestationresponse": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttestationResponse","type":"interface","url":"#authenticatorattestationresponse"},
-"#authenticatorcancel": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorcancel","type":"dfn","url":"#authenticatorcancel"},
-"#authenticatorgetassertion": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorgetassertion","type":"dfn","url":"#authenticatorgetassertion"},
-"#authenticatorid": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorid","type":"dfn","url":"#authenticatorid"},
-"#authenticatormakecredential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatormakecredential","type":"dfn","url":"#authenticatormakecredential"},
-"#authenticatorresponse": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorResponse","type":"interface","url":"#authenticatorresponse"},
-"#authorization-gesture": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authorization gesture","type":"dfn","url":"#authorization-gesture"},
-"#backed-up": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backed up","type":"dfn","url":"#backed-up"},
-"#backup-eligibility": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup eligibility","type":"dfn","url":"#backup-eligibility"},
-"#backup-eligible": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup eligible","type":"dfn","url":"#backup-eligible"},
-"#backup-state": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup state","type":"dfn","url":"#backup-state"},
-"#base64url-encoding": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"base64url encoding","type":"dfn","url":"#base64url-encoding"},
-"#basic": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"basic","type":"dfn","url":"#basic"},
-"#basic-attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"basic attestation","type":"dfn","url":"#basic-attestation"},
-"#batch-attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"batch attestation","type":"dfn","url":"#batch-attestation"},
-"#biometric-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"biometric authenticator","type":"dfn","url":"#biometric-authenticator"},
-"#biometric-recognition": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"biometric recognition","type":"dfn","url":"#biometric-recognition"},
-"#bound-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"bound credential","type":"dfn","url":"#bound-credential"},
-"#cbor": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cbor","type":"dfn","url":"#cbor"},
-"#ccdtostring": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ccdtostring","type":"dfn","url":"#ccdtostring"},
-"#cddl": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cddl","type":"dfn","url":"#cddl"},
-"#ceremony": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ceremony","type":"dfn","url":"#ceremony"},
-"#client": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client","type":"dfn","url":"#client"},
-"#client-data": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client data","type":"dfn","url":"#client-data"},
-"#client-device": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client device","type":"dfn","url":"#client-device"},
-"#client-extension": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension","type":"dfn","url":"#client-extension"},
-"#client-extension-input": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension input","type":"dfn","url":"#client-extension-input"},
-"#client-extension-output": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension output","type":"dfn","url":"#client-extension-output"},
-"#client-extension-processing": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension processing","type":"dfn","url":"#client-extension-processing"},
-"#client-platform": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client platform","type":"dfn","url":"#client-platform"},
-"#client-side": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side","type":"dfn","url":"#client-side"},
-"#client-side-credential-storage-modality": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side credential storage modality","type":"dfn","url":"#client-side-credential-storage-modality"},
-"#client-side-discoverable-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable credential","type":"dfn","url":"#client-side-discoverable-credential"},
-"#client-side-discoverable-public-key-credential-source": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable public key credential source","type":"dfn","url":"#client-side-discoverable-public-key-credential-source"},
-"#collectedclientdata-hash-of-the-serialized-client-data": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hash of the serialized client data","type":"dfn","url":"#collectedclientdata-hash-of-the-serialized-client-data"},
-"#collectedclientdata-json-compatible-serialization-of-client-data": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"json-compatible serialization of client data","type":"dfn","url":"#collectedclientdata-json-compatible-serialization-of-client-data"},
-"#concept-user-present": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user present","type":"dfn","url":"#concept-user-present"},
-"#concept-user-verified": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user verified","type":"dfn","url":"#concept-user-verified"},
-"#conforming-user-agent": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"conforming user agent","type":"dfn","url":"#conforming-user-agent"},
-"#contains": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"contains","type":"dfn","url":"#contains"},
-"#create-candidate-authenticator": {"export":true,"for_":["create"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"candidate authenticator","type":"dfn","url":"#create-candidate-authenticator"},
-"#create-selected-authenticator": {"export":true,"for_":["create"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"selected authenticator","type":"dfn","url":"#create-selected-authenticator"},
-"#created-on": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"created on","type":"dfn","url":"#created-on"},
-"#credential-descriptor-for-a-credential-record": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential descriptor for a credential record","type":"dfn","url":"#credential-descriptor-for-a-credential-record"},
-"#credential-id": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential id","type":"dfn","url":"#credential-id"},
-"#credential-id-looking-up": {"export":true,"for_":["credential id"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"looking up","type":"dfn","url":"#credential-id-looking-up"},
-"#credential-key-pair": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential key pair","type":"dfn","url":"#credential-key-pair"},
-"#credential-parameters": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential parameters","type":"dfn","url":"#credential-parameters"},
-"#credential-private-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential private key","type":"dfn","url":"#credential-private-key"},
-"#credential-properties": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential properties","type":"dfn","url":"#credential-properties"},
-"#credential-public-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential public key","type":"dfn","url":"#credential-public-key"},
-"#credential-record": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential record","type":"dfn","url":"#credential-record"},
-"#credential-record-supplemental-public-key-record": {"export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplemental public key record","type":"dfn","url":"#credential-record-supplemental-public-key-record"},
-"#credential-storage-modality": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential storage modality","type":"dfn","url":"#credential-storage-modality"},
-"#credentialcreationdata-attestationconveyancepreferenceoption": {"export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationconveyancepreferenceoption","type":"dfn","url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
-"#credentialcreationdata-attestationobjectresult": {"export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationobjectresult","type":"dfn","url":"#credentialcreationdata-attestationobjectresult"},
-"#credentialcreationdata-clientdatajsonresult": {"export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientdatajsonresult","type":"dfn","url":"#credentialcreationdata-clientdatajsonresult"},
-"#credentialcreationdata-clientextensionresults": {"export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientextensionresults","type":"dfn","url":"#credentialcreationdata-clientextensionresults"},
-"#credentialpropertiesoutput-resident-key-credential-property": {"export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident key credential property","type":"dfn","url":"#credentialpropertiesoutput-resident-key-credential-property"},
-"#credprops": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credprops","type":"dfn","url":"#credprops"},
-"#cross-platform-attachment": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cross-platform attachment","type":"dfn","url":"#cross-platform-attachment"},
-"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"determines the set of origins on which the public key credential may be exercised","type":"dfn","url":"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},
-"#dictdef-authenticationextensionsclientinputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientInputs","type":"dictionary","url":"#dictdef-authenticationextensionsclientinputs"},
-"#dictdef-authenticationextensionsclientinputsjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientInputsJSON","type":"dictionary","url":"#dictdef-authenticationextensionsclientinputsjson"},
-"#dictdef-authenticationextensionsclientoutputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientOutputs","type":"dictionary","url":"#dictdef-authenticationextensionsclientoutputs"},
-"#dictdef-authenticationextensionsclientoutputsjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientOutputsJSON","type":"dictionary","url":"#dictdef-authenticationextensionsclientoutputsjson"},
-"#dictdef-authenticationextensionslargeblobinputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsLargeBlobInputs","type":"dictionary","url":"#dictdef-authenticationextensionslargeblobinputs"},
-"#dictdef-authenticationextensionslargebloboutputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsLargeBlobOutputs","type":"dictionary","url":"#dictdef-authenticationextensionslargebloboutputs"},
-"#dictdef-authenticationextensionsprfinputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFInputs","type":"dictionary","url":"#dictdef-authenticationextensionsprfinputs"},
-"#dictdef-authenticationextensionsprfoutputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFOutputs","type":"dictionary","url":"#dictdef-authenticationextensionsprfoutputs"},
-"#dictdef-authenticationextensionsprfvalues": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFValues","type":"dictionary","url":"#dictdef-authenticationextensionsprfvalues"},
-"#dictdef-authenticationextensionssupplementalpubkeysinputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsSupplementalPubKeysInputs","type":"dictionary","url":"#dictdef-authenticationextensionssupplementalpubkeysinputs"},
-"#dictdef-authenticationextensionssupplementalpubkeysoutputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsSupplementalPubKeysOutputs","type":"dictionary","url":"#dictdef-authenticationextensionssupplementalpubkeysoutputs"},
-"#dictdef-authenticationresponsejson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationResponseJSON","type":"dictionary","url":"#dictdef-authenticationresponsejson"},
-"#dictdef-authenticatorassertionresponsejson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAssertionResponseJSON","type":"dictionary","url":"#dictdef-authenticatorassertionresponsejson"},
-"#dictdef-authenticatorattestationresponsejson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttestationResponseJSON","type":"dictionary","url":"#dictdef-authenticatorattestationresponsejson"},
-"#dictdef-authenticatorselectioncriteria": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorSelectionCriteria","type":"dictionary","url":"#dictdef-authenticatorselectioncriteria"},
-"#dictdef-collectedclientdata": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"CollectedClientData","type":"dictionary","url":"#dictdef-collectedclientdata"},
-"#dictdef-credentialpropertiesoutput": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"CredentialPropertiesOutput","type":"dictionary","url":"#dictdef-credentialpropertiesoutput"},
-"#dictdef-publickeycredentialcreationoptions": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialCreationOptions","type":"dictionary","url":"#dictdef-publickeycredentialcreationoptions"},
-"#dictdef-publickeycredentialcreationoptionsjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialCreationOptionsJSON","type":"dictionary","url":"#dictdef-publickeycredentialcreationoptionsjson"},
-"#dictdef-publickeycredentialdescriptor": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialDescriptor","type":"dictionary","url":"#dictdef-publickeycredentialdescriptor"},
-"#dictdef-publickeycredentialdescriptorjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialDescriptorJSON","type":"dictionary","url":"#dictdef-publickeycredentialdescriptorjson"},
-"#dictdef-publickeycredentialentity": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialEntity","type":"dictionary","url":"#dictdef-publickeycredentialentity"},
-"#dictdef-publickeycredentialparameters": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialParameters","type":"dictionary","url":"#dictdef-publickeycredentialparameters"},
-"#dictdef-publickeycredentialrequestoptions": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRequestOptions","type":"dictionary","url":"#dictdef-publickeycredentialrequestoptions"},
-"#dictdef-publickeycredentialrequestoptionsjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRequestOptionsJSON","type":"dictionary","url":"#dictdef-publickeycredentialrequestoptionsjson"},
-"#dictdef-publickeycredentialrpentity": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRpEntity","type":"dictionary","url":"#dictdef-publickeycredentialrpentity"},
-"#dictdef-publickeycredentialuserentity": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialUserEntity","type":"dictionary","url":"#dictdef-publickeycredentialuserentity"},
-"#dictdef-publickeycredentialuserentityjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialUserEntityJSON","type":"dictionary","url":"#dictdef-publickeycredentialuserentityjson"},
-"#dictdef-registrationresponsejson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"RegistrationResponseJSON","type":"dictionary","url":"#dictdef-registrationresponsejson"},
-"#discoverable-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverable credential","type":"dfn","url":"#discoverable-credential"},
-"#discoverable-credential-capable": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverable credential capable","type":"dfn","url":"#discoverable-credential-capable"},
-"#discoverablecredentialmetadata": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverablecredentialmetadata","type":"dfn","url":"#discoverablecredentialmetadata"},
-"#discoverablecredentialmetadata-id": {"export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dfn","url":"#discoverablecredentialmetadata-id"},
-"#discoverablecredentialmetadata-otherui": {"export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"otherui","type":"dfn","url":"#discoverablecredentialmetadata-otherui"},
-"#discoverablecredentialmetadata-type": {"export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dfn","url":"#discoverablecredentialmetadata-type"},
-"#dom-attestationconveyancepreference-direct": {"export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"direct","type":"enum-value","url":"#dom-attestationconveyancepreference-direct"},
-"#dom-attestationconveyancepreference-enterprise": {"export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"enterprise","type":"enum-value","url":"#dom-attestationconveyancepreference-enterprise"},
-"#dom-attestationconveyancepreference-indirect": {"export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"indirect","type":"enum-value","url":"#dom-attestationconveyancepreference-indirect"},
-"#dom-attestationconveyancepreference-none": {"export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"none","type":"enum-value","url":"#dom-attestationconveyancepreference-none"},
-"#dom-authenticationextensionsclientinputs-appid": {"export":true,"for_":["AuthenticationExtensionsClientInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appid","type":"dict-member","url":"#dom-authenticationextensionsclientinputs-appid"},
-"#dom-authenticationextensionsclientinputs-appidexclude": {"export":true,"for_":["AuthenticationExtensionsClientInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appidExclude","type":"dict-member","url":"#dom-authenticationextensionsclientinputs-appidexclude"},
-"#dom-authenticationextensionsclientinputs-supplementalpubkeys": {"export":true,"for_":["AuthenticationExtensionsClientInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplementalPubKeys","type":"dict-member","url":"#dom-authenticationextensionsclientinputs-supplementalpubkeys"},
-"#dom-authenticationextensionsclientoutputs-largeblob": {"export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"largeBlob","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-largeblob"},
-"#dom-authenticationextensionsclientoutputs-prf": {"export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"prf","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-prf"},
-"#dom-authenticationextensionsclientoutputs-supplementalpubkeys": {"export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplementalPubKeys","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-supplementalpubkeys"},
-"#dom-authenticationextensionslargeblobinputs-read": {"export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"read","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-read"},
-"#dom-authenticationextensionslargeblobinputs-support": {"export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"support","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-support"},
-"#dom-authenticationextensionslargeblobinputs-write": {"export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"write","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-write"},
-"#dom-authenticationextensionslargebloboutputs-blob": {"export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"blob","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-blob"},
-"#dom-authenticationextensionslargebloboutputs-supported": {"export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supported","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-supported"},
-"#dom-authenticationextensionslargebloboutputs-written": {"export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"written","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-written"},
-"#dom-authenticationextensionsprfinputs-eval": {"export":true,"for_":["AuthenticationExtensionsPRFInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"eval","type":"dict-member","url":"#dom-authenticationextensionsprfinputs-eval"},
-"#dom-authenticationextensionsprfinputs-evalbycredential": {"export":true,"for_":["AuthenticationExtensionsPRFInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"evalByCredential","type":"dict-member","url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
-"#dom-authenticationextensionsprfoutputs-enabled": {"export":true,"for_":["AuthenticationExtensionsPRFOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"enabled","type":"dict-member","url":"#dom-authenticationextensionsprfoutputs-enabled"},
-"#dom-authenticationextensionsprfoutputs-results": {"export":true,"for_":["AuthenticationExtensionsPRFOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"results","type":"dict-member","url":"#dom-authenticationextensionsprfoutputs-results"},
-"#dom-authenticationextensionsprfvalues-first": {"export":true,"for_":["AuthenticationExtensionsPRFValues"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"first","type":"dict-member","url":"#dom-authenticationextensionsprfvalues-first"},
-"#dom-authenticationextensionsprfvalues-second": {"export":true,"for_":["AuthenticationExtensionsPRFValues"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second","type":"dict-member","url":"#dom-authenticationextensionsprfvalues-second"},
-"#dom-authenticationextensionssupplementalpubkeysinputs-attestation": {"export":true,"for_":["AuthenticationExtensionsSupplementalPubKeysInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation","type":"dict-member","url":"#dom-authenticationextensionssupplementalpubkeysinputs-attestation"},
-"#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats": {"export":true,"for_":["AuthenticationExtensionsSupplementalPubKeysInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationFormats","type":"dict-member","url":"#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"},
-"#dom-authenticationextensionssupplementalpubkeysinputs-scopes": {"export":true,"for_":["AuthenticationExtensionsSupplementalPubKeysInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"scopes","type":"dict-member","url":"#dom-authenticationextensionssupplementalpubkeysinputs-scopes"},
-"#dom-authenticationextensionssupplementalpubkeysoutputs-signatures": {"export":true,"for_":["AuthenticationExtensionsSupplementalPubKeysOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signatures","type":"dict-member","url":"#dom-authenticationextensionssupplementalpubkeysoutputs-signatures"},
-"#dom-authenticationresponsejson-clientextensionresults": {"export":true,"for_":["AuthenticationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientExtensionResults","type":"dict-member","url":"#dom-authenticationresponsejson-clientextensionresults"},
-"#dom-authenticatorassertionresponse-authenticatordata": {"export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorData","type":"attribute","url":"#dom-authenticatorassertionresponse-authenticatordata"},
-"#dom-authenticatorassertionresponse-signature": {"export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signature","type":"attribute","url":"#dom-authenticatorassertionresponse-signature"},
-"#dom-authenticatorassertionresponse-userhandle": {"export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userHandle","type":"attribute","url":"#dom-authenticatorassertionresponse-userhandle"},
-"#dom-authenticatorattachment-cross-platform": {"export":true,"for_":["AuthenticatorAttachment"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"cross-platform\"","type":"enum-value","url":"#dom-authenticatorattachment-cross-platform"},
-"#dom-authenticatorattachment-platform": {"export":true,"for_":["AuthenticatorAttachment"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"platform\"","type":"enum-value","url":"#dom-authenticatorattachment-platform"},
-"#dom-authenticatorattestationresponse-attestationobject": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationObject","type":"attribute","url":"#dom-authenticatorattestationresponse-attestationobject"},
-"#dom-authenticatorattestationresponse-getauthenticatordata": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getAuthenticatorData()","type":"method","url":"#dom-authenticatorattestationresponse-getauthenticatordata"},
-"#dom-authenticatorattestationresponse-getpublickey": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getPublicKey()","type":"method","url":"#dom-authenticatorattestationresponse-getpublickey"},
-"#dom-authenticatorattestationresponse-getpublickeyalgorithm": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getPublicKeyAlgorithm()","type":"method","url":"#dom-authenticatorattestationresponse-getpublickeyalgorithm"},
-"#dom-authenticatorattestationresponse-gettransports": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getTransports()","type":"method","url":"#dom-authenticatorattestationresponse-gettransports"},
-"#dom-authenticatorattestationresponse-transports-slot": {"export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[transports]]","type":"attribute","url":"#dom-authenticatorattestationresponse-transports-slot"},
-"#dom-authenticatorattestationresponsejson-publickey": {"export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-publickey"},
-"#dom-authenticatorattestationresponsejson-publickeyalgorithm": {"export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKeyAlgorithm","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-publickeyalgorithm"},
-"#dom-authenticatorattestationresponsejson-transports": {"export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-transports"},
-"#dom-authenticatorresponse-clientdatajson": {"export":true,"for_":["AuthenticatorResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientDataJSON","type":"attribute","url":"#dom-authenticatorresponse-clientdatajson"},
-"#dom-authenticatorselectioncriteria-authenticatorattachment": {"export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorAttachment","type":"dict-member","url":"#dom-authenticatorselectioncriteria-authenticatorattachment"},
-"#dom-authenticatorselectioncriteria-requireresidentkey": {"export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"requireResidentKey","type":"dict-member","url":"#dom-authenticatorselectioncriteria-requireresidentkey"},
-"#dom-authenticatorselectioncriteria-residentkey": {"export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"residentKey","type":"dict-member","url":"#dom-authenticatorselectioncriteria-residentkey"},
-"#dom-authenticatorselectioncriteria-userverification": {"export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userVerification","type":"dict-member","url":"#dom-authenticatorselectioncriteria-userverification"},
-"#dom-authenticatortransport-ble": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"ble\"","type":"enum-value","url":"#dom-authenticatortransport-ble"},
-"#dom-authenticatortransport-hybrid": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hybrid","type":"enum-value","url":"#dom-authenticatortransport-hybrid"},
-"#dom-authenticatortransport-internal": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"internal","type":"enum-value","url":"#dom-authenticatortransport-internal"},
-"#dom-authenticatortransport-nfc": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"nfc\"","type":"enum-value","url":"#dom-authenticatortransport-nfc"},
-"#dom-authenticatortransport-smart-card": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"smart-card\"","type":"enum-value","url":"#dom-authenticatortransport-smart-card"},
-"#dom-authenticatortransport-usb": {"export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"usb\"","type":"enum-value","url":"#dom-authenticatortransport-usb"},
-"#dom-clientcapability-conditionalcreate": {"export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"conditionalCreate","type":"enum-value","url":"#dom-clientcapability-conditionalcreate"},
-"#dom-clientcapability-conditionalmediation": {"export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"conditionalMediation\"","type":"enum-value","url":"#dom-clientcapability-conditionalmediation"},
-"#dom-clientcapability-hybridtransport": {"export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"hybridTransport\"","type":"enum-value","url":"#dom-clientcapability-hybridtransport"},
-"#dom-clientcapability-passkeyplatformauthenticator": {"export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"passkeyPlatformAuthenticator\"","type":"enum-value","url":"#dom-clientcapability-passkeyplatformauthenticator"},
-"#dom-clientcapability-userverifyingplatformauthenticator": {"export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"userVerifyingPlatformAuthenticator\"","type":"enum-value","url":"#dom-clientcapability-userverifyingplatformauthenticator"},
-"#dom-collectedclientdata-challenge": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-collectedclientdata-challenge"},
-"#dom-collectedclientdata-crossorigin": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"crossOrigin","type":"dict-member","url":"#dom-collectedclientdata-crossorigin"},
-"#dom-collectedclientdata-origin": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"dict-member","url":"#dom-collectedclientdata-origin"},
-"#dom-collectedclientdata-tokenbinding": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"tokenbinding","type":"dfn","url":"#dom-collectedclientdata-tokenbinding"},
-"#dom-collectedclientdata-toporigin": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"topOrigin","type":"dict-member","url":"#dom-collectedclientdata-toporigin"},
-"#dom-collectedclientdata-type": {"export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-collectedclientdata-type"},
-"#dom-credentialcreationoptions-publickey": {"export":true,"for_":["CredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialcreationoptions-publickey"},
-"#dom-credentialpropertiesoutput-authenticatordisplayname": {"export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorDisplayName","type":"dict-member","url":"#dom-credentialpropertiesoutput-authenticatordisplayname"},
-"#dom-credentialpropertiesoutput-rk": {"export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rk","type":"dict-member","url":"#dom-credentialpropertiesoutput-rk"},
-"#dom-credentialrequestoptions-publickey": {"export":true,"for_":["CredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialrequestoptions-publickey"},
-"#dom-largeblobsupport-preferred": {"export":true,"for_":["LargeBlobSupport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"preferred\"","type":"enum-value","url":"#dom-largeblobsupport-preferred"},
-"#dom-largeblobsupport-required": {"export":true,"for_":["LargeBlobSupport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"required\"","type":"enum-value","url":"#dom-largeblobsupport-required"},
-"#dom-publickeycredential-authenticatorattachment": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorAttachment","type":"attribute","url":"#dom-publickeycredential-authenticatorattachment"},
-"#dom-publickeycredential-clientextensionsresults-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[clientExtensionsResults]]","type":"attribute","url":"#dom-publickeycredential-clientextensionsresults-slot"},
-"#dom-publickeycredential-collectfromcredentialstore-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-collectfromcredentialstore-slot"},
-"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin": {"export":true,"for_":["PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"argument","url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"},
-"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"export":true,"for_":["PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"sameOriginWithAncestors","type":"argument","url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
-"#dom-publickeycredential-create-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[Create]](origin, options, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-create-slot"},
-"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin": {"export":true,"for_":["PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"argument","url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"},
-"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"export":true,"for_":["PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"sameOriginWithAncestors","type":"argument","url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
-"#dom-publickeycredential-discoverfromexternalsource-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-discoverfromexternalsource-slot"},
-"#dom-publickeycredential-getclientcapabilities": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getClientCapabilities()","type":"method","url":"#dom-publickeycredential-getclientcapabilities"},
-"#dom-publickeycredential-getclientextensionresults": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getClientExtensionResults()","type":"method","url":"#dom-publickeycredential-getclientextensionresults"},
-"#dom-publickeycredential-identifier-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[identifier]]","type":"attribute","url":"#dom-publickeycredential-identifier-slot"},
-"#dom-publickeycredential-isconditionalmediationavailable": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"isConditionalMediationAvailable()","type":"method","url":"#dom-publickeycredential-isconditionalmediationavailable"},
-"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"isUserVerifyingPlatformAuthenticatorAvailable()","type":"method","url":"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"},
-"#dom-publickeycredential-parsecreationoptionsfromjson-options-options": {"export":true,"for_":["PublicKeyCredential/parseCreationOptionsFromJSON(options)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"options","type":"argument","url":"#dom-publickeycredential-parsecreationoptionsfromjson-options-options"},
-"#dom-publickeycredential-parserequestoptionsfromjson-options-options": {"export":true,"for_":["PublicKeyCredential/parseRequestOptionsFromJSON(options)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"options","type":"argument","url":"#dom-publickeycredential-parserequestoptionsfromjson-options-options"},
-"#dom-publickeycredential-rawid": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rawId","type":"attribute","url":"#dom-publickeycredential-rawid"},
-"#dom-publickeycredential-response": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"response","type":"attribute","url":"#dom-publickeycredential-response"},
-"#dom-publickeycredential-store-slot": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[Store]](credential, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-store-slot"},
-"#dom-publickeycredential-tojson": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"toJSON()","type":"method","url":"#dom-publickeycredential-tojson"},
-"#dom-publickeycredentialcreationoptions-attestation": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-attestation"},
-"#dom-publickeycredentialcreationoptions-attestationformats": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationFormats","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-attestationformats"},
-"#dom-publickeycredentialcreationoptions-authenticatorselection": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorSelection","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-authenticatorselection"},
-"#dom-publickeycredentialcreationoptions-challenge": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-challenge"},
-"#dom-publickeycredentialcreationoptions-excludecredentials": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"excludeCredentials","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
-"#dom-publickeycredentialcreationoptions-extensions": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-extensions"},
-"#dom-publickeycredentialcreationoptions-hints": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hints","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-hints"},
-"#dom-publickeycredentialcreationoptions-pubkeycredparams": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"pubKeyCredParams","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
-"#dom-publickeycredentialcreationoptions-rp": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rp","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-rp"},
-"#dom-publickeycredentialcreationoptions-timeout": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"timeout","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-timeout"},
-"#dom-publickeycredentialcreationoptions-user": {"export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-user"},
-"#dom-publickeycredentialdescriptor-id": {"export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialdescriptor-id"},
-"#dom-publickeycredentialdescriptor-transports": {"export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"dict-member","url":"#dom-publickeycredentialdescriptor-transports"},
-"#dom-publickeycredentialdescriptor-type": {"export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-publickeycredentialdescriptor-type"},
-"#dom-publickeycredentialentity-name": {"export":true,"for_":["PublicKeyCredentialEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"name","type":"dict-member","url":"#dom-publickeycredentialentity-name"},
-"#dom-publickeycredentialhints-client-device": {"export":true,"for_":["PublicKeyCredentialHints"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"client-device\"","type":"enum-value","url":"#dom-publickeycredentialhints-client-device"},
-"#dom-publickeycredentialhints-hybrid": {"export":true,"for_":["PublicKeyCredentialHints"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"hybrid\"","type":"enum-value","url":"#dom-publickeycredentialhints-hybrid"},
-"#dom-publickeycredentialhints-security-key": {"export":true,"for_":["PublicKeyCredentialHints"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"security-key\"","type":"enum-value","url":"#dom-publickeycredentialhints-security-key"},
-"#dom-publickeycredentialparameters-alg": {"export":true,"for_":["PublicKeyCredentialParameters"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"alg","type":"dict-member","url":"#dom-publickeycredentialparameters-alg"},
-"#dom-publickeycredentialparameters-type": {"export":true,"for_":["PublicKeyCredentialParameters"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-publickeycredentialparameters-type"},
-"#dom-publickeycredentialrequestoptions-allowcredentials": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"allowCredentials","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-allowcredentials"},
-"#dom-publickeycredentialrequestoptions-challenge": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-challenge"},
-"#dom-publickeycredentialrequestoptions-extensions": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-extensions"},
-"#dom-publickeycredentialrequestoptions-hints": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hints","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-hints"},
-"#dom-publickeycredentialrequestoptions-rpid": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpId","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-rpid"},
-"#dom-publickeycredentialrequestoptions-timeout": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"timeout","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-timeout"},
-"#dom-publickeycredentialrequestoptions-userverification": {"export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userVerification","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-userverification"},
-"#dom-publickeycredentialrpentity-id": {"export":true,"for_":["PublicKeyCredentialRpEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialrpentity-id"},
-"#dom-publickeycredentialtype-public-key": {"export":true,"for_":["PublicKeyCredentialType"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public-key","type":"enum-value","url":"#dom-publickeycredentialtype-public-key"},
-"#dom-publickeycredentialuserentity-displayname": {"export":true,"for_":["PublicKeyCredentialUserEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"displayName","type":"dict-member","url":"#dom-publickeycredentialuserentity-displayname"},
-"#dom-publickeycredentialuserentity-id": {"export":true,"for_":["PublicKeyCredentialUserEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialuserentity-id"},
-"#dom-registrationresponsejson-clientextensionresults": {"export":true,"for_":["RegistrationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientExtensionResults","type":"dict-member","url":"#dom-registrationresponsejson-clientextensionresults"},
-"#dom-residentkeyrequirement-discouraged": {"export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discouraged","type":"enum-value","url":"#dom-residentkeyrequirement-discouraged"},
-"#dom-residentkeyrequirement-preferred": {"export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"preferred","type":"enum-value","url":"#dom-residentkeyrequirement-preferred"},
-"#dom-residentkeyrequirement-required": {"export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"required","type":"enum-value","url":"#dom-residentkeyrequirement-required"},
-"#dom-tokenbinding-id": {"export":true,"for_":["TokenBinding"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-tokenbinding-id"},
-"#dom-tokenbinding-status": {"export":true,"for_":["TokenBinding"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"status","type":"dict-member","url":"#dom-tokenbinding-status"},
-"#dom-tokenbindingstatus-present": {"export":true,"for_":["TokenBindingStatus"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"present\"","type":"enum-value","url":"#dom-tokenbindingstatus-present"},
-"#dom-tokenbindingstatus-supported": {"export":true,"for_":["TokenBindingStatus"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"supported\"","type":"enum-value","url":"#dom-tokenbindingstatus-supported"},
-"#dom-userverificationrequirement-discouraged": {"export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discouraged","type":"enum-value","url":"#dom-userverificationrequirement-discouraged"},
-"#dom-userverificationrequirement-preferred": {"export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"preferred","type":"enum-value","url":"#dom-userverificationrequirement-preferred"},
-"#dom-userverificationrequirement-required": {"export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"required","type":"enum-value","url":"#dom-userverificationrequirement-required"},
-"#effective-resident-key-requirement-for-credential-creation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective resident key requirement for credential creation","type":"dfn","url":"#effective-resident-key-requirement-for-credential-creation"},
-"#effective-user-verification-requirement-for-assertion": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective user verification requirement for assertion","type":"dfn","url":"#effective-user-verification-requirement-for-assertion"},
-"#effective-user-verification-requirement-for-credential-creation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective user verification requirement for credential creation","type":"dfn","url":"#effective-user-verification-requirement-for-credential-creation"},
-"#enumdef-attestationconveyancepreference": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AttestationConveyancePreference","type":"enum","url":"#enumdef-attestationconveyancepreference"},
-"#enumdef-authenticatorattachment": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttachment","type":"enum","url":"#enumdef-authenticatorattachment"},
-"#enumdef-authenticatortransport": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorTransport","type":"enum","url":"#enumdef-authenticatortransport"},
-"#enumdef-clientcapability": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ClientCapability","type":"enum","url":"#enumdef-clientcapability"},
-"#enumdef-largeblobsupport": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"LargeBlobSupport","type":"enum","url":"#enumdef-largeblobsupport"},
-"#enumdef-publickeycredentialhints": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialHints","type":"enum","url":"#enumdef-publickeycredentialhints"},
-"#enumdef-publickeycredentialtype": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialType","type":"enum","url":"#enumdef-publickeycredentialtype"},
-"#enumdef-residentkeyrequirement": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ResidentKeyRequirement","type":"enum","url":"#enumdef-residentkeyrequirement"},
-"#enumdef-tokenbindingstatus": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"TokenBindingStatus","type":"enum","url":"#enumdef-tokenbindingstatus"},
-"#enumdef-userverificationrequirement": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"UserVerificationRequirement","type":"enum","url":"#enumdef-userverificationrequirement"},
-"#extension-identifier": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extension identifier","type":"dfn","url":"#extension-identifier"},
-"#first-factor-roaming-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"first-factor roaming authenticator","type":"dfn","url":"#first-factor-roaming-authenticator"},
-"#generating-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"generating authenticator","type":"dfn","url":"#generating-authenticator"},
-"#get-credentials": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"get credentials","type":"dfn","url":"#get-credentials"},
-"#human-palatability": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"human palatability","type":"dfn","url":"#human-palatability"},
-"#largeblob": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"largeblob","type":"dfn","url":"#largeblob"},
-"#multi-device-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"multi-device credential","type":"dfn","url":"#multi-device-credential"},
-"#multi-factor-capable": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"multi-factor capable","type":"dfn","url":"#multi-factor-capable"},
-"#non-discoverable-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"non-discoverable credential","type":"dfn","url":"#non-discoverable-credential"},
-"#non-resident-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"non-resident credential","type":"dfn","url":"#non-resident-credential"},
-"#none": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"none","type":"dfn","url":"#none"},
-"#passkey-platform-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"passkey platform authenticator","type":"dfn","url":"#passkey-platform-authenticator"},
-"#platform-attachment": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform attachment","type":"dfn","url":"#platform-attachment"},
-"#platform-authenticators": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform authenticators","type":"dfn","url":"#platform-authenticators"},
-"#platform-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform credential","type":"dfn","url":"#platform-credential"},
-"#prf": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"prf","type":"dfn","url":"#prf"},
-"#public-key-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public key credential","type":"dfn","url":"#public-key-credential"},
-"#public-key-credential-source": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public key credential source","type":"dfn","url":"#public-key-credential-source"},
-"#public-key-credential-source-id": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dfn","url":"#public-key-credential-source-id"},
-"#public-key-credential-source-managing-authenticator": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"managing authenticator","type":"dfn","url":"#public-key-credential-source-managing-authenticator"},
-"#public-key-credential-source-mutable-item": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"mutable item","type":"dfn","url":"#public-key-credential-source-mutable-item"},
-"#public-key-credential-source-otherui": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"otherui","type":"dfn","url":"#public-key-credential-source-otherui"},
-"#public-key-credential-source-privatekey": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"privatekey","type":"dfn","url":"#public-key-credential-source-privatekey"},
-"#public-key-credential-source-rpid": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpid","type":"dfn","url":"#public-key-credential-source-rpid"},
-"#public-key-credential-source-type": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dfn","url":"#public-key-credential-source-type"},
-"#public-key-credential-source-userhandle": {"export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userhandle","type":"dfn","url":"#public-key-credential-source-userhandle"},
-"#publickey-credentials-get-feature": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publickey-credentials-get-feature","type":"dfn","url":"#publickey-credentials-get-feature"},
-"#publickeycredential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredential","type":"interface","url":"#publickeycredential"},
-"#publickeycredential-issuing-a-credential-request-to-an-authenticator": {"export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"issuing a credential request to an authenticator","type":"dfn","url":"#publickeycredential-issuing-a-credential-request-to-an-authenticator"},
-"#rate-limiting": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rate limiting","type":"dfn","url":"#rate-limiting"},
-"#recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"recommended range and default for a webauthn ceremony timeout","type":"dfn","url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
-"#registration": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration","type":"dfn","url":"#registration"},
-"#registration-ceremony": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration ceremony","type":"dfn","url":"#registration-ceremony"},
-"#registration-extension": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration extension","type":"dfn","url":"#registration-extension"},
-"#relying-party": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"relying party","type":"dfn","url":"#relying-party"},
-"#relying-party-identifier": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"relying party identifier","type":"dfn","url":"#relying-party-identifier"},
-"#remove-all-credentials": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove all credentials","type":"dfn","url":"#remove-all-credentials"},
-"#remove-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove credential","type":"dfn","url":"#remove-credential"},
-"#remove-virtual-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove virtual authenticator","type":"dfn","url":"#remove-virtual-authenticator"},
-"#resident-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident credential","type":"dfn","url":"#resident-credential"},
-"#resident-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident key","type":"dfn","url":"#resident-key"},
-"#roaming-authenticators": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"roaming authenticators","type":"dfn","url":"#roaming-authenticators"},
-"#roaming-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"roaming credential","type":"dfn","url":"#roaming-credential"},
-"#rp-id": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rp id","type":"dfn","url":"#rp-id"},
-"#scope": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"scope","type":"dfn","url":"#scope"},
-"#second-factor-platform-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second-factor platform authenticator","type":"dfn","url":"#second-factor-platform-authenticator"},
-"#second-factor-roaming-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second-factor roaming authenticator","type":"dfn","url":"#second-factor-roaming-authenticator"},
-"#self": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"self","type":"dfn","url":"#self"},
-"#self-attestation": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"self attestation","type":"dfn","url":"#self-attestation"},
-"#server-side-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side credential","type":"dfn","url":"#server-side-credential"},
-"#server-side-credential-storage-modality": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side credential storage modality","type":"dfn","url":"#server-side-credential-storage-modality"},
-"#server-side-public-key-credential-source": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side public key credential source","type":"dfn","url":"#server-side-public-key-credential-source"},
-"#set-credential-properties": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set credential properties","type":"dfn","url":"#set-credential-properties"},
-"#set-credential-properties-parameters": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set credential properties parameters","type":"dfn","url":"#set-credential-properties-parameters"},
-"#set-user-verified": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set user verified","type":"dfn","url":"#set-user-verified"},
-"#signature-counter": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signature counter","type":"dfn","url":"#signature-counter"},
-"#signing-procedure": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signing procedure","type":"dfn","url":"#signing-procedure"},
-"#silentcredentialdiscovery": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"silentcredentialdiscovery","type":"dfn","url":"#silentcredentialdiscovery"},
-"#single-device-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"single-device credential","type":"dfn","url":"#single-device-credential"},
-"#single-factor-capable": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"single-factor capable","type":"dfn","url":"#single-factor-capable"},
-"#supplemental-public-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplemental public key","type":"dfn","url":"#supplemental-public-key"},
-"#supplementalpubkeys": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supplementalpubkeys","type":"dfn","url":"#supplementalpubkeys"},
-"#test-of-user-presence": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"test of user presence","type":"dfn","url":"#test-of-user-presence"},
-"#typedefdef-base64urlstring": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"Base64URLString","type":"typedef","url":"#typedefdef-base64urlstring"},
-"#typedefdef-cosealgorithmidentifier": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"COSEAlgorithmIdentifier","type":"typedef","url":"#typedefdef-cosealgorithmidentifier"},
-"#typedefdef-publickeycredentialclientcapabilities": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialClientCapabilities","type":"typedef","url":"#typedefdef-publickeycredentialclientcapabilities"},
-"#typedefdef-publickeycredentialjson": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialJSON","type":"typedef","url":"#typedefdef-publickeycredentialjson"},
-"#typedefdef-uvmentries": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"UvmEntries","type":"typedef","url":"#typedefdef-uvmentries"},
-"#typedefdef-uvmentry": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"UvmEntry","type":"typedef","url":"#typedefdef-uvmentry"},
-"#ui-redressing": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ui redressing","type":"dfn","url":"#ui-redressing"},
-"#unsigned-extension-outputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"unsigned extension outputs","type":"dfn","url":"#unsigned-extension-outputs"},
-"#user-account": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user account","type":"dfn","url":"#user-account"},
-"#user-consent": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user consent","type":"dfn","url":"#user-consent"},
-"#user-credential": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user credential","type":"dfn","url":"#user-credential"},
-"#user-handle": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user handle","type":"dfn","url":"#user-handle"},
-"#user-public-key": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user public key","type":"dfn","url":"#user-public-key"},
-"#user-verification": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user verification","type":"dfn","url":"#user-verification"},
-"#user-verification-method": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user verification method","type":"dfn","url":"#user-verification-method"},
-"#user-verifying-platform-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user-verifying platform authenticator","type":"dfn","url":"#user-verifying-platform-authenticator"},
-"#verification-procedure": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"verification procedure","type":"dfn","url":"#verification-procedure"},
-"#verification-procedure-inputs": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"verification procedure inputs","type":"dfn","url":"#verification-procedure-inputs"},
-"#virtual-authenticator-database": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"virtual authenticator database","type":"dfn","url":"#virtual-authenticator-database"},
-"#virtual-authenticators": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"virtual authenticators","type":"dfn","url":"#virtual-authenticators"},
-"#web-application": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"web application","type":"dfn","url":"#web-application"},
-"#web-authentication-api": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"web authentication api","type":"dfn","url":"#web-authentication-api"},
-"#webauthn-authenticator": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn authenticator","type":"dfn","url":"#webauthn-authenticator"},
-"#webauthn-client": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn client","type":"dfn","url":"#webauthn-client"},
-"#webauthn-client-device": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn client device","type":"dfn","url":"#webauthn-client-device"},
-"#webauthn-extensions": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn extensions","type":"dfn","url":"#webauthn-extensions"},
-"#webauthn-relying-party": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn relying party","type":"dfn","url":"#webauthn-relying-party"},
-"#webauthn-signature": {"export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn signature","type":"dfn","url":"#webauthn-signature"},
-"https://dom.spec.whatwg.org/#abortcontroller": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"AbortController","type":"interface","url":"https://dom.spec.whatwg.org/#abortcontroller"},
-"https://dom.spec.whatwg.org/#abortsignal": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"AbortSignal","type":"interface","url":"https://dom.spec.whatwg.org/#abortsignal"},
-"https://dom.spec.whatwg.org/#abortsignal-abort-reason": {"export":true,"for_":["AbortSignal"],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"abort reason","type":"dfn","url":"https://dom.spec.whatwg.org/#abortsignal-abort-reason"},
-"https://dom.spec.whatwg.org/#abortsignal-aborted": {"export":true,"for_":["AbortSignal"],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"aborted","type":"dfn","url":"https://dom.spec.whatwg.org/#abortsignal-aborted"},
-"https://dom.spec.whatwg.org/#concept-document": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"document","type":"dfn","url":"https://dom.spec.whatwg.org/#concept-document"},
-"https://dom.spec.whatwg.org/#document": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"Document","type":"interface","url":"https://dom.spec.whatwg.org/#document"},
-"https://encoding.spec.whatwg.org/#utf-8-decode": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 decode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
-"https://encoding.spec.whatwg.org/#utf-8-encode": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 encode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
-"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types": {"export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.2 key protection types","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types"},
-"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types": {"export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.3 matcher protection types","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types"},
-"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats": {"export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.6.2 public key representation formats","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats"},
-"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods": {"export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.1 user verification methods","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods"},
-"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate": {"export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"application parameter","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate"},
-"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success": {"export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"section 5.4","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},
-"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success": {"export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"section 4.3","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success"},
-"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-appid","spec":"fido-appid","status":"anchor-block","text":"determining if a caller's facetid is authorized for an appid","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid"},
-"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-appid","spec":"fido-appid","status":"anchor-block","text":"determining the facetid of a calling application","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application"},
-"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"\u00a76. authenticator api","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
-"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"large, per-credential blobs","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs"},
-"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"ctap2 canonical cbor encoding form","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
-"https://heycam.github.io/webidl#dfn-get-buffer-source-copy": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webidl","spec":"webidl","status":"anchor-block","text":"get a copy of the bytes held by the buffer source","type":"dfn","url":"https://heycam.github.io/webidl#dfn-get-buffer-source-copy"},
-"https://html.spec.whatwg.org/#focus": {"export":true,"for_":[],"level":"","normative":true,"shortname":"whatwg html","spec":"whatwg html","status":"anchor-block","text":"focus","type":"dfn","url":"https://html.spec.whatwg.org/#focus"},
-"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"ascii serialization of an origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin"},
-"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"browsing context","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
-"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"effective domain","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
-"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host": {"export":true,"for_":["origin"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"host","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host"},
-"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme": {"export":true,"for_":["origin"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"scheme","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme"},
-"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"is a registrable domain suffix of or is equal to","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
-"https://html.spec.whatwg.org/multipage/browsers.html#same-site": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"same site","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
-"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy": {"export":true,"for_":["Document"],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"permissions policy","type":"dfn","url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
-"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete": {"export":true,"for_":["button","fieldset","input","object","output","select","textarea"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"autocomplete","type":"element-attr","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete"},
-"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"autofill detail token","type":"dfn","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens"},
-"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"non-autofill credential type","type":"dfn","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type"},
-"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"textarea","type":"element","url":"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element"},
-"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"allowed to use","type":"dfn","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
-"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow": {"export":true,"for_":["iframe"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"allow","type":"element-attr","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow"},
-"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"iframe","type":"element","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
-"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"in parallel","type":"dfn","url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
-"https://html.spec.whatwg.org/multipage/input.html#the-input-element": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"input","type":"element","url":"https://html.spec.whatwg.org/multipage/input.html#the-input-element"},
-"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"consume user activation","type":"dfn","url":"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation"},
-"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"transient activation","type":"dfn","url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
-"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"Window","type":"interface","url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window"},
-"https://html.spec.whatwg.org/multipage/origin.html#concept-origin": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
-"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"opaque origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
-"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"document.domain","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin": {"export":true,"for_":["environment"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"top-level origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"relevant global object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global": {"export":true,"for_":["environment settings object"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"global object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin": {"export":true,"for_":["environment settings object"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"current settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"environment settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"relevant settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
-"https://html.spec.whatwg.org/multipage/webappapis.html#secure-context": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"secure context","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#secure-context"},
-"https://infra.spec.whatwg.org/#boolean": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"boolean","type":"dfn","url":"https://infra.spec.whatwg.org/#boolean"},
-"https://infra.spec.whatwg.org/#byte-sequence": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"byte sequence","type":"dfn","url":"https://infra.spec.whatwg.org/#byte-sequence"},
-"https://infra.spec.whatwg.org/#iteration-continue": {"export":true,"for_":["iteration"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"continue","type":"dfn","url":"https://infra.spec.whatwg.org/#iteration-continue"},
-"https://infra.spec.whatwg.org/#iteration-while": {"export":true,"for_":["iteration"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"while","type":"dfn","url":"https://infra.spec.whatwg.org/#iteration-while"},
-"https://infra.spec.whatwg.org/#list": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"list","type":"dfn","url":"https://infra.spec.whatwg.org/#list"},
-"https://infra.spec.whatwg.org/#list-append": {"export":true,"for_":["list"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"append","type":"dfn","url":"https://infra.spec.whatwg.org/#list-append"},
-"https://infra.spec.whatwg.org/#list-empty": {"export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"empty","type":"dfn","url":"https://infra.spec.whatwg.org/#list-empty"},
-"https://infra.spec.whatwg.org/#list-is-empty": {"export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"is empty","type":"dfn","url":"https://infra.spec.whatwg.org/#list-is-empty"},
-"https://infra.spec.whatwg.org/#list-item": {"export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"item","type":"dfn","url":"https://infra.spec.whatwg.org/#list-item"},
-"https://infra.spec.whatwg.org/#list-iterate": {"export":true,"for_":["list","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"for each","type":"dfn","url":"https://infra.spec.whatwg.org/#list-iterate"},
-"https://infra.spec.whatwg.org/#list-remove": {"export":true,"for_":["list","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"remove","type":"dfn","url":"https://infra.spec.whatwg.org/#list-remove"},
-"https://infra.spec.whatwg.org/#list-size": {"export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"size","type":"dfn","url":"https://infra.spec.whatwg.org/#list-size"},
-"https://infra.spec.whatwg.org/#map-entry": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"entry","type":"dfn","url":"https://infra.spec.whatwg.org/#map-entry"},
-"https://infra.spec.whatwg.org/#map-exists": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"exist","type":"dfn","url":"https://infra.spec.whatwg.org/#map-exists"},
-"https://infra.spec.whatwg.org/#map-getting-the-keys": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"keys","type":"dfn","url":"https://infra.spec.whatwg.org/#map-getting-the-keys"},
-"https://infra.spec.whatwg.org/#map-iterate": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"for each","type":"dfn","url":"https://infra.spec.whatwg.org/#map-iterate"},
-"https://infra.spec.whatwg.org/#map-key": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"key","type":"dfn","url":"https://infra.spec.whatwg.org/#map-key"},
-"https://infra.spec.whatwg.org/#map-set": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"set","type":"dfn","url":"https://infra.spec.whatwg.org/#map-set"},
-"https://infra.spec.whatwg.org/#map-value": {"export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"value","type":"dfn","url":"https://infra.spec.whatwg.org/#map-value"},
-"https://infra.spec.whatwg.org/#ordered-map": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"map","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-map"},
-"https://infra.spec.whatwg.org/#ordered-set": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"ordered set","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-set"},
-"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"serialize json to bytes","type":"dfn","url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes"},
-"https://infra.spec.whatwg.org/#set-append": {"export":true,"for_":["set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"append","type":"dfn","url":"https://infra.spec.whatwg.org/#set-append"},
-"https://infra.spec.whatwg.org/#set-intersection": {"export":true,"for_":["set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"intersection","type":"dfn","url":"https://infra.spec.whatwg.org/#set-intersection"},
-"https://infra.spec.whatwg.org/#struct": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"struct","type":"dfn","url":"https://infra.spec.whatwg.org/#struct"},
-"https://infra.spec.whatwg.org/#struct-item": {"export":true,"for_":["struct","tuple"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"item","type":"dfn","url":"https://infra.spec.whatwg.org/#struct-item"},
-"https://infra.spec.whatwg.org/#willful-violation": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"willful violation","type":"dfn","url":"https://infra.spec.whatwg.org/#willful-violation"},
-"https://pages.nist.gov/800-63-3/sp800-63-3.html#af": {"export":true,"for_":[],"level":"","normative":true,"shortname":"sp800-800-63r3","spec":"sp800-800-63r3","status":"anchor-block","text":"authentication factor","type":"dfn","url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf": {"export":true,"for_":[],"level":"","normative":true,"shortname":"sp800-800-63r3","spec":"sp800-800-63r3","status":"anchor-block","text":"single-factor","type":"dfn","url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf"},
-"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor": {"export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"%arraybuffer%","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor"},
-"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots": {"export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"internal method","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
-"https://tc39.github.io/ecma262/#sec-own-property": {"export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"own property","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-own-property"},
-"https://tools.ietf.org/html/bcp47#section-2.1": {"export":true,"for_":[],"level":"","normative":true,"shortname":"bcp47","spec":"bcp47","status":"anchor-block","text":"language tag","type":"dfn","url":"https://tools.ietf.org/html/bcp47#section-2.1"},
-"https://tools.ietf.org/html/rfc4949#page-186": {"export":true,"for_":[],"level":"","normative":true,"shortname":"rfc4949","spec":"rfc4949","status":"anchor-block","text":"man-in-the-middle attack","type":"dfn","url":"https://tools.ietf.org/html/rfc4949#page-186"},
-"https://tools.ietf.org/html/rfc4949#page-258": {"export":true,"for_":[],"level":"","normative":true,"shortname":"rfc4949","spec":"rfc4949","status":"anchor-block","text":"salted","type":"dfn","url":"https://tools.ietf.org/html/rfc4949#page-258"},
-"https://tools.ietf.org/html/rfc5280#section-4.1.2.7": {"export":true,"for_":[],"level":"","normative":true,"shortname":"rfc5280","spec":"rfc5280","status":"anchor-block","text":"subjectpublickeyinfo","type":"dfn","url":"https://tools.ietf.org/html/rfc5280#section-4.1.2.7"},
-"https://tools.ietf.org/html/rfc8230#section-2": {"export":true,"for_":["RFC8230"],"level":"","normative":true,"shortname":"rfc8230","spec":"rfc8230","status":"anchor-block","text":"section 2","type":"dfn","url":"https://tools.ietf.org/html/rfc8230#section-2"},
-"https://tools.ietf.org/html/rfc8230#section-4": {"export":true,"for_":["RFC8230"],"level":"","normative":true,"shortname":"rfc8230","spec":"rfc8230","status":"anchor-block","text":"section 4","type":"dfn","url":"https://tools.ietf.org/html/rfc8230#section-4"},
-"https://tools.ietf.org/html/rfc8471#section-1": {"export":true,"for_":[],"level":"","normative":true,"shortname":"tokenbinding","spec":"tokenbinding","status":"anchor-block","text":"token binding","type":"dfn","url":"https://tools.ietf.org/html/rfc8471#section-1"},
-"https://tools.ietf.org/html/rfc8471#section-3.2": {"export":true,"for_":[],"level":"","normative":true,"shortname":"tokenbinding","spec":"tokenbinding","status":"anchor-block","text":"token binding id","type":"dfn","url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
-"https://tools.ietf.org/html/rfc8610#section-3.9": {"export":true,"for_":[],"level":"","normative":true,"shortname":"rfc8610","spec":"rfc8610","status":"anchor-block","text":"group sockets","type":"dfn","url":"https://tools.ietf.org/html/rfc8610#section-3.9"},
-"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters": {"export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"kty","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
-"https://tools.ietf.org/html/rfc9052#name-key-objects": {"export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"cose key","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#name-key-objects"},
-"https://tools.ietf.org/html/rfc9052#section-7": {"export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"section 7","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#section-7"},
-"https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves": {"export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"crv","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves"},
-"https://tools.ietf.org/html/rfc9053#section-2": {"export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 2","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-2"},
-"https://tools.ietf.org/html/rfc9053#section-2.1": {"export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 2.1","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-2.1"},
-"https://tools.ietf.org/html/rfc9053#section-7.1": {"export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 7.1","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-7.1"},
-"https://url.spec.whatwg.org#concept-url-port": {"export":true,"for_":[],"level":"","normative":true,"shortname":"url","spec":"url","status":"anchor-block","text":"port","type":"dfn","url":"https://url.spec.whatwg.org#concept-url-port"},
-"https://url.spec.whatwg.org#concept-url-scheme": {"export":true,"for_":[],"level":"","normative":true,"shortname":"url","spec":"url","status":"anchor-block","text":"scheme","type":"dfn","url":"https://url.spec.whatwg.org#concept-url-scheme"},
-"https://url.spec.whatwg.org/#concept-domain": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"domain","type":"dfn","url":"https://url.spec.whatwg.org/#concept-domain"},
-"https://url.spec.whatwg.org/#concept-ipv4": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"ipv4 address","type":"dfn","url":"https://url.spec.whatwg.org/#concept-ipv4"},
-"https://url.spec.whatwg.org/#concept-ipv6": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"ipv6 address","type":"dfn","url":"https://url.spec.whatwg.org/#concept-ipv6"},
-"https://url.spec.whatwg.org/#concept-url-host": {"export":true,"for_":["url"],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"host","type":"dfn","url":"https://url.spec.whatwg.org/#concept-url-host"},
-"https://url.spec.whatwg.org/#empty-host": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"empty host","type":"dfn","url":"https://url.spec.whatwg.org/#empty-host"},
-"https://url.spec.whatwg.org/#opaque-host": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"opaque host","type":"dfn","url":"https://url.spec.whatwg.org/#opaque-host"},
-"https://url.spec.whatwg.org/#valid-domain": {"export":false,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"valid domain","type":"dfn","url":"https://url.spec.whatwg.org/#valid-domain"},
-"https://url.spec.whatwg.org/#valid-domain-string": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"valid domain string","type":"dfn","url":"https://url.spec.whatwg.org/#valid-domain-string"},
-"https://w3c.github.io/FileAPI/#blob-url-entry-object": {"export":true,"for_":["blob URL entry"],"level":"1","normative":true,"shortname":"fileapi","spec":"fileapi","status":"current","text":"object","type":"dfn","url":"https://w3c.github.io/FileAPI/#blob-url-entry-object"},
-"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster": {"export":true,"for_":[],"level":"1","normative":false,"shortname":"i18n-glossary","spec":"i18n-glossary","status":"current","text":"grapheme cluster","type":"dfn","url":"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster"},
-"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Create a Credential","type":"abstract-op","url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential"},
-"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Request a Credential","type":"abstract-op","url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
-"https://w3c.github.io/webappsec-credential-management/#concept-credential": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"credential","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
-"https://w3c.github.io/webappsec-credential-management/#credential": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Credential","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credential"},
-"https://w3c.github.io/webappsec-credential-management/#credential-source": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"credential source","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#credential-source"},
-"https://w3c.github.io/webappsec-credential-management/#credentialscontainer": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"CredentialsContainer","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},
-"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"CredentialCreationOptions","type":"dictionary","url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions"},
-"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"CredentialRequestOptions","type":"dictionary","url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[Create]](origin, options, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote": {"export":true,"for_":["Credential/[[discovery]]"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"remote","type":"enum-value","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[discovery]]","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-id": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"id","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-id"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[Store]](credential, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-type": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"type","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot": {"export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[type]]","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal": {"export":true,"for_":["CredentialCreationOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"signal","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional": {"export":true,"for_":["CredentialMediationRequirement"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"conditional","type":"enum-value","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation": {"export":true,"for_":["CredentialRequestOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"mediation","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal": {"export":true,"for_":["CredentialRequestOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"signal","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create": {"export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"create()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get": {"export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"get()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess": {"export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"preventSilentAccess()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess"},
-"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store": {"export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"store()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store"},
-"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"same-origin with its ancestors","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
-"https://w3c.github.io/webappsec-credential-management/#user-mediated": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"user mediation","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#user-mediated"},
-"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"permissions-policy","spec":"permissions-policy-1","status":"current","text":"policy-controlled feature","type":"dfn","url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature"},
-"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist": {"export":true,"for_":["policy-controlled feature"],"level":"1","normative":true,"shortname":"permissions-policy","spec":"permissions-policy-1","status":"current","text":"default allowlists","type":"dfn","url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist"},
-"https://w3c.github.io/webdriver/#dfn-endpoint-node": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"endpoint node","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-endpoint-node"},
-"https://w3c.github.io/webdriver/#dfn-error": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"webdriver error","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-error"},
-"https://w3c.github.io/webdriver/#dfn-error-code": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"webdriver error code","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-error-code"},
-"https://w3c.github.io/webdriver/#dfn-extension-capability": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"extension capability","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-extension-capability"},
-"https://w3c.github.io/webdriver/#dfn-extension-commands": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"extension command","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-extension-commands"},
-"https://w3c.github.io/webdriver/#dfn-getting-properties": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"getting a property","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-getting-properties"},
-"https://w3c.github.io/webdriver/#dfn-invalid-argument": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"invalid argument","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-invalid-argument"},
-"https://w3c.github.io/webdriver/#dfn-matching-capabilities": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"matching capabilities","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-matching-capabilities"},
-"https://w3c.github.io/webdriver/#dfn-remote-end-steps": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"remote end steps","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-remote-end-steps"},
-"https://w3c.github.io/webdriver/#dfn-set-a-property": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"set a property","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-set-a-property"},
-"https://w3c.github.io/webdriver/#dfn-success": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"success","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-success"},
-"https://w3c.github.io/webdriver/#dfn-unsupported-operation": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"unsupported operation","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-unsupported-operation"},
-"https://w3c.github.io/webdriver/#dfn-validate-capabilities": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"validating capabilities","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-validate-capabilities"},
-"https://webidl.spec.whatwg.org/#BufferSource": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"BufferSource","type":"typedef","url":"https://webidl.spec.whatwg.org/#BufferSource"},
-"https://webidl.spec.whatwg.org/#Exposed": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"Exposed","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#Exposed"},
-"https://webidl.spec.whatwg.org/#SameObject": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SameObject","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SameObject"},
-"https://webidl.spec.whatwg.org/#SecureContext": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SecureContext","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SecureContext"},
-"https://webidl.spec.whatwg.org/#constrainterror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ConstraintError","type":"exception","url":"https://webidl.spec.whatwg.org/#constrainterror"},
-"https://webidl.spec.whatwg.org/#dfn-buffer-source-type": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"buffer source types","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
-"https://webidl.spec.whatwg.org/#dfn-enumeration-value": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"enumeration value","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-enumeration-value"},
-"https://webidl.spec.whatwg.org/#dfn-interface-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"interface object","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-interface-object"},
-"https://webidl.spec.whatwg.org/#dfn-json-types": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"json type","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
-"https://webidl.spec.whatwg.org/#encodingerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"EncodingError","type":"exception","url":"https://webidl.spec.whatwg.org/#encodingerror"},
-"https://webidl.spec.whatwg.org/#exceptiondef-typeerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"TypeError","type":"exception","url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
-"https://webidl.spec.whatwg.org/#idl-ArrayBuffer": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ArrayBuffer","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},
-"https://webidl.spec.whatwg.org/#idl-DOMException": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"DOMException","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
-"https://webidl.spec.whatwg.org/#idl-DOMString": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"DOMString","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
-"https://webidl.spec.whatwg.org/#idl-USVString": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"USVString","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-USVString"},
-"https://webidl.spec.whatwg.org/#idl-boolean": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"boolean","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-boolean"},
-"https://webidl.spec.whatwg.org/#idl-long": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"long","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-long"},
-"https://webidl.spec.whatwg.org/#idl-long-long": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"long long","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-long-long"},
-"https://webidl.spec.whatwg.org/#idl-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"object","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-object"},
-"https://webidl.spec.whatwg.org/#idl-promise": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"Promise","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-promise"},
-"https://webidl.spec.whatwg.org/#idl-record": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"record","type":"dfn","url":"https://webidl.spec.whatwg.org/#idl-record"},
-"https://webidl.spec.whatwg.org/#idl-sequence": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"sequence","type":"dfn","url":"https://webidl.spec.whatwg.org/#idl-sequence"},
-"https://webidl.spec.whatwg.org/#idl-unsigned-long": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"unsigned long","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-unsigned-long"},
-"https://webidl.spec.whatwg.org/#invalidstateerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"InvalidStateError","type":"exception","url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
-"https://webidl.spec.whatwg.org/#notallowederror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"NotAllowedError","type":"exception","url":"https://webidl.spec.whatwg.org/#notallowederror"},
-"https://webidl.spec.whatwg.org/#notsupportederror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"NotSupportedError","type":"exception","url":"https://webidl.spec.whatwg.org/#notsupportederror"},
-"https://webidl.spec.whatwg.org/#securityerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SecurityError","type":"exception","url":"https://webidl.spec.whatwg.org/#securityerror"},
-"https://webidl.spec.whatwg.org/#syntaxerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SyntaxError","type":"exception","url":"https://webidl.spec.whatwg.org/#syntaxerror"},
-"https://webidl.spec.whatwg.org/#unknownerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"UnknownError","type":"exception","url":"https://webidl.spec.whatwg.org/#unknownerror"},
-"https://www.w3.org/TR/page-visibility/#visibility-states": {"export":true,"for_":[],"level":"","normative":true,"shortname":"page-visibility","spec":"page-visibility","status":"anchor-block","text":"visibility states","type":"dfn","url":"https://www.w3.org/TR/page-visibility/#visibility-states"},
+"#aaguid": {"displayText":"aaguid","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"aaguid","type":"dfn","url":"#aaguid"},
+"#abstract-opdef-asynchronous-rp-id-validation-algorithm": {"displayText":"Asynchronous RP ID validation algorithm","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"Asynchronous RP ID validation algorithm","type":"abstract-op","url":"#abstract-opdef-asynchronous-rp-id-validation-algorithm"},
+"#abstract-opdef-credential-record-attestationclientdatajson": {"displayText":"attestationClientDataJSON","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationClientDataJSON","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationclientdatajson"},
+"#abstract-opdef-credential-record-attestationobject": {"displayText":"attestationObject","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationObject","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationobject"},
+"#abstract-opdef-credential-record-backupeligible": {"displayText":"backupEligible","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupEligible","type":"abstract-op","url":"#abstract-opdef-credential-record-backupeligible"},
+"#abstract-opdef-credential-record-backupstate": {"displayText":"backupState","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupState","type":"abstract-op","url":"#abstract-opdef-credential-record-backupstate"},
+"#abstract-opdef-credential-record-id": {"displayText":"id","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"abstract-op","url":"#abstract-opdef-credential-record-id"},
+"#abstract-opdef-credential-record-publickey": {"displayText":"publicKey","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"abstract-op","url":"#abstract-opdef-credential-record-publickey"},
+"#abstract-opdef-credential-record-signcount": {"displayText":"signCount","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signCount","type":"abstract-op","url":"#abstract-opdef-credential-record-signcount"},
+"#abstract-opdef-credential-record-transports": {"displayText":"transports","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"abstract-op","url":"#abstract-opdef-credential-record-transports"},
+"#abstract-opdef-credential-record-type": {"displayText":"type","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"abstract-op","url":"#abstract-opdef-credential-record-type"},
+"#abstract-opdef-credential-record-uvinitialized": {"displayText":"uvInitialized","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"uvInitialized","type":"abstract-op","url":"#abstract-opdef-credential-record-uvinitialized"},
+"#abstract-opdef-related-origins-validation-procedure": {"displayText":"related origins validation procedure","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"related origins validation procedure","type":"abstract-op","url":"#abstract-opdef-related-origins-validation-procedure"},
+"#add-credential": {"displayText":"add credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"add credential","type":"dfn","url":"#add-credential"},
+"#add-virtual-authenticator": {"displayText":"add virtual authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"add virtual authenticator","type":"dfn","url":"#add-virtual-authenticator"},
+"#android-key-attestation-certificate-extension-data": {"displayText":"android key attestation certificate extension data","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"android key attestation certificate extension data","type":"dfn","url":"#android-key-attestation-certificate-extension-data"},
+"#anonca": {"displayText":"anonca","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"anonca","type":"dfn","url":"#anonca"},
+"#anonymization-ca": {"displayText":"anonymization ca","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"anonymization ca","type":"dfn","url":"#anonymization-ca"},
+"#appid": {"displayText":"appid","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appid","type":"dfn","url":"#appid"},
+"#assertion": {"displayText":"assertion","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"assertion","type":"dfn","url":"#assertion"},
+"#assertion-signature": {"displayText":"assertion signature","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"assertion signature","type":"dfn","url":"#assertion-signature"},
+"#assertioncreationdata-authenticatordataresult": {"displayText":"authenticatordataresult","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatordataresult","type":"dfn","url":"#assertioncreationdata-authenticatordataresult"},
+"#assertioncreationdata-clientdatajsonresult": {"displayText":"clientdatajsonresult","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientdatajsonresult","type":"dfn","url":"#assertioncreationdata-clientdatajsonresult"},
+"#assertioncreationdata-clientextensionresults": {"displayText":"clientextensionresults","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientextensionresults","type":"dfn","url":"#assertioncreationdata-clientextensionresults"},
+"#assertioncreationdata-credentialidresult": {"displayText":"credentialidresult","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialidresult","type":"dfn","url":"#assertioncreationdata-credentialidresult"},
+"#assertioncreationdata-signatureresult": {"displayText":"signatureresult","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signatureresult","type":"dfn","url":"#assertioncreationdata-signatureresult"},
+"#assertioncreationdata-userhandleresult": {"displayText":"userhandleresult","export":true,"for_":["assertionCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userhandleresult","type":"dfn","url":"#assertioncreationdata-userhandleresult"},
+"#attca": {"displayText":"attca","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attca","type":"dfn","url":"#attca"},
+"#attestation": {"displayText":"attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation","type":"dfn","url":"#attestation"},
+"#attestation-ca": {"displayText":"attestation ca","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation ca","type":"dfn","url":"#attestation-ca"},
+"#attestation-certificate": {"displayText":"attestation certificate","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation certificate","type":"dfn","url":"#attestation-certificate"},
+"#attestation-conveyance": {"displayText":"attestation conveyance","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation conveyance","type":"dfn","url":"#attestation-conveyance"},
+"#attestation-key-pair": {"displayText":"attestation key pair","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation key pair","type":"dfn","url":"#attestation-key-pair"},
+"#attestation-object": {"displayText":"attestation object","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation object","type":"dfn","url":"#attestation-object"},
+"#attestation-private-key": {"displayText":"attestation private key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation private key","type":"dfn","url":"#attestation-private-key"},
+"#attestation-public-key": {"displayText":"attestation public key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation public key","type":"dfn","url":"#attestation-public-key"},
+"#attestation-signature": {"displayText":"attestation signature","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation signature","type":"dfn","url":"#attestation-signature"},
+"#attestation-statement": {"displayText":"attestation statement","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement","type":"dfn","url":"#attestation-statement"},
+"#attestation-statement-format": {"displayText":"attestation statement format","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement format","type":"dfn","url":"#attestation-statement-format"},
+"#attestation-statement-format-identifier": {"displayText":"attestation statement format identifier","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation statement format identifier","type":"dfn","url":"#attestation-statement-format-identifier"},
+"#attestation-trust-path": {"displayText":"attestation trust path","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation trust path","type":"dfn","url":"#attestation-trust-path"},
+"#attestation-type": {"displayText":"attestation type","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation type","type":"dfn","url":"#attestation-type"},
+"#attested-credential-data": {"displayText":"attested credential data","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attested credential data","type":"dfn","url":"#attested-credential-data"},
+"#authdata-attestedcredentialdata": {"displayText":"attestedcredentialdata","export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestedcredentialdata","type":"dfn","url":"#authdata-attestedcredentialdata"},
+"#authdata-attestedcredentialdata-aaguid": {"displayText":"aaguid","export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"aaguid","type":"dfn","url":"#authdata-attestedcredentialdata-aaguid"},
+"#authdata-attestedcredentialdata-credentialid": {"displayText":"credentialid","export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialid","type":"dfn","url":"#authdata-attestedcredentialdata-credentialid"},
+"#authdata-attestedcredentialdata-credentialidlength": {"displayText":"credentialidlength","export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialidlength","type":"dfn","url":"#authdata-attestedcredentialdata-credentialidlength"},
+"#authdata-attestedcredentialdata-credentialpublickey": {"displayText":"credentialpublickey","export":true,"for_":["authData/attestedCredentialData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialpublickey","type":"dfn","url":"#authdata-attestedcredentialdata-credentialpublickey"},
+"#authdata-extensions": {"displayText":"extensions","export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dfn","url":"#authdata-extensions"},
+"#authdata-flags": {"displayText":"flags","export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"flags","type":"dfn","url":"#authdata-flags"},
+"#authdata-flags-at": {"displayText":"at","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"at","type":"dfn","url":"#authdata-flags-at"},
+"#authdata-flags-be": {"displayText":"be","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"be","type":"dfn","url":"#authdata-flags-be"},
+"#authdata-flags-bs": {"displayText":"bs","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"bs","type":"dfn","url":"#authdata-flags-bs"},
+"#authdata-flags-ed": {"displayText":"ed","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ed","type":"dfn","url":"#authdata-flags-ed"},
+"#authdata-flags-up": {"displayText":"up","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"up","type":"dfn","url":"#authdata-flags-up"},
+"#authdata-flags-uv": {"displayText":"uv","export":true,"for_":["authData/flags"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"uv","type":"dfn","url":"#authdata-flags-uv"},
+"#authdata-rpidhash": {"displayText":"rpidhash","export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpidhash","type":"dfn","url":"#authdata-rpidhash"},
+"#authdata-signcount": {"displayText":"signcount","export":true,"for_":["authData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signcount","type":"dfn","url":"#authdata-signcount"},
+"#authentication": {"displayText":"authentication","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication","type":"dfn","url":"#authentication"},
+"#authentication-assertion": {"displayText":"authentication assertion","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication assertion","type":"dfn","url":"#authentication-assertion"},
+"#authentication-ceremony": {"displayText":"authentication ceremony","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication ceremony","type":"dfn","url":"#authentication-ceremony"},
+"#authentication-extension": {"displayText":"authentication extension","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication extension","type":"dfn","url":"#authentication-extension"},
+"#authentication-factor-capability": {"displayText":"authentication factor capability","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authentication factor capability","type":"dfn","url":"#authentication-factor-capability"},
+"#authenticator": {"displayText":"authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator","type":"dfn","url":"#authenticator"},
+"#authenticator-attachment-modality": {"displayText":"authenticator attachment modality","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator attachment modality","type":"dfn","url":"#authenticator-attachment-modality"},
+"#authenticator-configuration": {"displayText":"authenticator configuration","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator configuration","type":"dfn","url":"#authenticator-configuration"},
+"#authenticator-credentials-map": {"displayText":"credentials map","export":true,"for_":["authenticator"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentials map","type":"dfn","url":"#authenticator-credentials-map"},
+"#authenticator-data": {"displayText":"authenticator data","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data","type":"dfn","url":"#authenticator-data"},
+"#authenticator-data-claimed-to-have-been-used-for-the-attestation": {"displayText":"authenticator data claimed to have been used for the attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data claimed to have been used for the attestation","type":"dfn","url":"#authenticator-data-claimed-to-have-been-used-for-the-attestation"},
+"#authenticator-data-for-the-attestation": {"displayText":"authenticator data for the attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator data for the attestation","type":"dfn","url":"#authenticator-data-for-the-attestation"},
+"#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure": {"displayText":"perform the following steps to generate an authenticator data structure","export":true,"for_":["authenticator data"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"perform the following steps to generate an authenticator data structure","type":"dfn","url":"#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure"},
+"#authenticator-extension": {"displayText":"authenticator extension","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension","type":"dfn","url":"#authenticator-extension"},
+"#authenticator-extension-capabilities": {"displayText":"authenticator extension capabilities","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension capabilities","type":"dfn","url":"#authenticator-extension-capabilities"},
+"#authenticator-extension-input": {"displayText":"authenticator extension input","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension input","type":"dfn","url":"#authenticator-extension-input"},
+"#authenticator-extension-output": {"displayText":"authenticator extension output","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension output","type":"dfn","url":"#authenticator-extension-output"},
+"#authenticator-extension-processing": {"displayText":"authenticator extension processing","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator extension processing","type":"dfn","url":"#authenticator-extension-processing"},
+"#authenticator-model": {"displayText":"authenticator model","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator model","type":"dfn","url":"#authenticator-model"},
+"#authenticator-operations": {"displayText":"authenticator operations","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator operations","type":"dfn","url":"#authenticator-operations"},
+"#authenticator-session": {"displayText":"authenticator session","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator session","type":"dfn","url":"#authenticator-session"},
+"#authenticator-type": {"displayText":"authenticator type","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator type","type":"dfn","url":"#authenticator-type"},
+"#authenticatorassertionresponse": {"displayText":"AuthenticatorAssertionResponse","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAssertionResponse","type":"interface","url":"#authenticatorassertionresponse"},
+"#authenticatorattestationresponse": {"displayText":"AuthenticatorAttestationResponse","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttestationResponse","type":"interface","url":"#authenticatorattestationresponse"},
+"#authenticatorcancel": {"displayText":"authenticatorcancel","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorcancel","type":"dfn","url":"#authenticatorcancel"},
+"#authenticatorgetassertion": {"displayText":"authenticatorgetassertion","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorgetassertion","type":"dfn","url":"#authenticatorgetassertion"},
+"#authenticatorid": {"displayText":"authenticatorid","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorid","type":"dfn","url":"#authenticatorid"},
+"#authenticatormakecredential": {"displayText":"authenticatormakecredential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatormakecredential","type":"dfn","url":"#authenticatormakecredential"},
+"#authenticatorresponse": {"displayText":"AuthenticatorResponse","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorResponse","type":"interface","url":"#authenticatorresponse"},
+"#authorization-gesture": {"displayText":"authorization gesture","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authorization gesture","type":"dfn","url":"#authorization-gesture"},
+"#backed-up": {"displayText":"backed up","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backed up","type":"dfn","url":"#backed-up"},
+"#backup-eligibility": {"displayText":"backup eligibility","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup eligibility","type":"dfn","url":"#backup-eligibility"},
+"#backup-eligible": {"displayText":"backup eligible","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup eligible","type":"dfn","url":"#backup-eligible"},
+"#backup-state": {"displayText":"backup state","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backup state","type":"dfn","url":"#backup-state"},
+"#base64url-encoding": {"displayText":"base64url encoding","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"base64url encoding","type":"dfn","url":"#base64url-encoding"},
+"#basic": {"displayText":"basic","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"basic","type":"dfn","url":"#basic"},
+"#basic-attestation": {"displayText":"basic attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"basic attestation","type":"dfn","url":"#basic-attestation"},
+"#batch-attestation": {"displayText":"batch attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"batch attestation","type":"dfn","url":"#batch-attestation"},
+"#biometric-authenticator": {"displayText":"biometric authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"biometric authenticator","type":"dfn","url":"#biometric-authenticator"},
+"#biometric-recognition": {"displayText":"biometric recognition","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"biometric recognition","type":"dfn","url":"#biometric-recognition"},
+"#bound-credential": {"displayText":"bound credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"bound credential","type":"dfn","url":"#bound-credential"},
+"#cbor": {"displayText":"cbor","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cbor","type":"dfn","url":"#cbor"},
+"#ccdtostring": {"displayText":"ccdtostring","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ccdtostring","type":"dfn","url":"#ccdtostring"},
+"#cddl": {"displayText":"cddl","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cddl","type":"dfn","url":"#cddl"},
+"#ceremony": {"displayText":"ceremony","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ceremony","type":"dfn","url":"#ceremony"},
+"#client": {"displayText":"client","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client","type":"dfn","url":"#client"},
+"#client-data": {"displayText":"client data","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client data","type":"dfn","url":"#client-data"},
+"#client-device": {"displayText":"client device","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client device","type":"dfn","url":"#client-device"},
+"#client-extension": {"displayText":"client extension","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension","type":"dfn","url":"#client-extension"},
+"#client-extension-input": {"displayText":"client extension input","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension input","type":"dfn","url":"#client-extension-input"},
+"#client-extension-output": {"displayText":"client extension output","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension output","type":"dfn","url":"#client-extension-output"},
+"#client-extension-processing": {"displayText":"client extension processing","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client extension processing","type":"dfn","url":"#client-extension-processing"},
+"#client-platform": {"displayText":"client platform","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client platform","type":"dfn","url":"#client-platform"},
+"#client-side": {"displayText":"client-side","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side","type":"dfn","url":"#client-side"},
+"#client-side-credential-storage-modality": {"displayText":"client-side credential storage modality","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side credential storage modality","type":"dfn","url":"#client-side-credential-storage-modality"},
+"#client-side-discoverable-credential": {"displayText":"client-side discoverable credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable credential","type":"dfn","url":"#client-side-discoverable-credential"},
+"#client-side-discoverable-public-key-credential-source": {"displayText":"client-side discoverable public key credential source","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable public key credential source","type":"dfn","url":"#client-side-discoverable-public-key-credential-source"},
+"#collectedclientdata-hash-of-the-serialized-client-data": {"displayText":"hash of the serialized client data","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hash of the serialized client data","type":"dfn","url":"#collectedclientdata-hash-of-the-serialized-client-data"},
+"#collectedclientdata-json-compatible-serialization-of-client-data": {"displayText":"json-compatible serialization of client data","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"json-compatible serialization of client data","type":"dfn","url":"#collectedclientdata-json-compatible-serialization-of-client-data"},
+"#concept-user-present": {"displayText":"user present","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user present","type":"dfn","url":"#concept-user-present"},
+"#concept-user-verified": {"displayText":"user verified","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user verified","type":"dfn","url":"#concept-user-verified"},
+"#conforming-user-agent": {"displayText":"conforming user agent","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"conforming user agent","type":"dfn","url":"#conforming-user-agent"},
+"#contains": {"displayText":"contains","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"contains","type":"dfn","url":"#contains"},
+"#create-candidate-authenticator": {"displayText":"candidate authenticator","export":true,"for_":["create"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"candidate authenticator","type":"dfn","url":"#create-candidate-authenticator"},
+"#create-selected-authenticator": {"displayText":"selected authenticator","export":true,"for_":["create"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"selected authenticator","type":"dfn","url":"#create-selected-authenticator"},
+"#created-on": {"displayText":"created on","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"created on","type":"dfn","url":"#created-on"},
+"#credential-descriptor-for-a-credential-record": {"displayText":"credential descriptor for a credential record","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential descriptor for a credential record","type":"dfn","url":"#credential-descriptor-for-a-credential-record"},
+"#credential-id": {"displayText":"credential id","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential id","type":"dfn","url":"#credential-id"},
+"#credential-id-looking-up": {"displayText":"looking up","export":true,"for_":["credential id"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"looking up","type":"dfn","url":"#credential-id-looking-up"},
+"#credential-key-pair": {"displayText":"credential key pair","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential key pair","type":"dfn","url":"#credential-key-pair"},
+"#credential-parameters": {"displayText":"credential parameters","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential parameters","type":"dfn","url":"#credential-parameters"},
+"#credential-private-key": {"displayText":"credential private key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential private key","type":"dfn","url":"#credential-private-key"},
+"#credential-properties": {"displayText":"credential properties","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential properties","type":"dfn","url":"#credential-properties"},
+"#credential-public-key": {"displayText":"credential public key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential public key","type":"dfn","url":"#credential-public-key"},
+"#credential-record": {"displayText":"credential record","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential record","type":"dfn","url":"#credential-record"},
+"#credential-storage-modality": {"displayText":"credential storage modality","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credential storage modality","type":"dfn","url":"#credential-storage-modality"},
+"#credentialcreationdata-attestationconveyancepreferenceoption": {"displayText":"attestationconveyancepreferenceoption","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationconveyancepreferenceoption","type":"dfn","url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
+"#credentialcreationdata-attestationobjectresult": {"displayText":"attestationobjectresult","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationobjectresult","type":"dfn","url":"#credentialcreationdata-attestationobjectresult"},
+"#credentialcreationdata-clientdatajsonresult": {"displayText":"clientdatajsonresult","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientdatajsonresult","type":"dfn","url":"#credentialcreationdata-clientdatajsonresult"},
+"#credentialcreationdata-clientextensionresults": {"displayText":"clientextensionresults","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientextensionresults","type":"dfn","url":"#credentialcreationdata-clientextensionresults"},
+"#credentialpropertiesoutput-client-side-discoverable-credential-property": {"displayText":"client-side discoverable credential property","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable credential property","type":"dfn","url":"#credentialpropertiesoutput-client-side-discoverable-credential-property"},
+"#credentialpropertiesoutput-resident-key-credential-property": {"displayText":"resident key credential property","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident key credential property","type":"dfn","url":"#credentialpropertiesoutput-resident-key-credential-property"},
+"#credprops": {"displayText":"credprops","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credprops","type":"dfn","url":"#credprops"},
+"#cross-platform-attachment": {"displayText":"cross-platform attachment","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cross-platform attachment","type":"dfn","url":"#cross-platform-attachment"},
+"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised": {"displayText":"determines the set of origins on which the public key credential may be exercised","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"determines the set of origins on which the public key credential may be exercised","type":"dfn","url":"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},
+"#dictdef-allacceptedcredentialsoptions": {"displayText":"AllAcceptedCredentialsOptions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AllAcceptedCredentialsOptions","type":"dictionary","url":"#dictdef-allacceptedcredentialsoptions"},
+"#dictdef-authenticationextensionsclientinputs": {"displayText":"AuthenticationExtensionsClientInputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientInputs","type":"dictionary","url":"#dictdef-authenticationextensionsclientinputs"},
+"#dictdef-authenticationextensionsclientinputsjson": {"displayText":"AuthenticationExtensionsClientInputsJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientInputsJSON","type":"dictionary","url":"#dictdef-authenticationextensionsclientinputsjson"},
+"#dictdef-authenticationextensionsclientoutputs": {"displayText":"AuthenticationExtensionsClientOutputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientOutputs","type":"dictionary","url":"#dictdef-authenticationextensionsclientoutputs"},
+"#dictdef-authenticationextensionsclientoutputsjson": {"displayText":"AuthenticationExtensionsClientOutputsJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsClientOutputsJSON","type":"dictionary","url":"#dictdef-authenticationextensionsclientoutputsjson"},
+"#dictdef-authenticationextensionslargeblobinputs": {"displayText":"AuthenticationExtensionsLargeBlobInputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsLargeBlobInputs","type":"dictionary","url":"#dictdef-authenticationextensionslargeblobinputs"},
+"#dictdef-authenticationextensionslargebloboutputs": {"displayText":"AuthenticationExtensionsLargeBlobOutputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsLargeBlobOutputs","type":"dictionary","url":"#dictdef-authenticationextensionslargebloboutputs"},
+"#dictdef-authenticationextensionsprfinputs": {"displayText":"AuthenticationExtensionsPRFInputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFInputs","type":"dictionary","url":"#dictdef-authenticationextensionsprfinputs"},
+"#dictdef-authenticationextensionsprfoutputs": {"displayText":"AuthenticationExtensionsPRFOutputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFOutputs","type":"dictionary","url":"#dictdef-authenticationextensionsprfoutputs"},
+"#dictdef-authenticationextensionsprfvalues": {"displayText":"AuthenticationExtensionsPRFValues","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationExtensionsPRFValues","type":"dictionary","url":"#dictdef-authenticationextensionsprfvalues"},
+"#dictdef-authenticationresponsejson": {"displayText":"AuthenticationResponseJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticationResponseJSON","type":"dictionary","url":"#dictdef-authenticationresponsejson"},
+"#dictdef-authenticatorassertionresponsejson": {"displayText":"AuthenticatorAssertionResponseJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAssertionResponseJSON","type":"dictionary","url":"#dictdef-authenticatorassertionresponsejson"},
+"#dictdef-authenticatorattestationresponsejson": {"displayText":"AuthenticatorAttestationResponseJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttestationResponseJSON","type":"dictionary","url":"#dictdef-authenticatorattestationresponsejson"},
+"#dictdef-authenticatorselectioncriteria": {"displayText":"AuthenticatorSelectionCriteria","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorSelectionCriteria","type":"dictionary","url":"#dictdef-authenticatorselectioncriteria"},
+"#dictdef-collectedclientdata": {"displayText":"CollectedClientData","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"CollectedClientData","type":"dictionary","url":"#dictdef-collectedclientdata"},
+"#dictdef-credentialpropertiesoutput": {"displayText":"CredentialPropertiesOutput","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"CredentialPropertiesOutput","type":"dictionary","url":"#dictdef-credentialpropertiesoutput"},
+"#dictdef-currentuserdetailsoptions": {"displayText":"CurrentUserDetailsOptions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"CurrentUserDetailsOptions","type":"dictionary","url":"#dictdef-currentuserdetailsoptions"},
+"#dictdef-publickeycredentialcreationoptions": {"displayText":"PublicKeyCredentialCreationOptions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialCreationOptions","type":"dictionary","url":"#dictdef-publickeycredentialcreationoptions"},
+"#dictdef-publickeycredentialcreationoptionsjson": {"displayText":"PublicKeyCredentialCreationOptionsJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialCreationOptionsJSON","type":"dictionary","url":"#dictdef-publickeycredentialcreationoptionsjson"},
+"#dictdef-publickeycredentialdescriptor": {"displayText":"PublicKeyCredentialDescriptor","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialDescriptor","type":"dictionary","url":"#dictdef-publickeycredentialdescriptor"},
+"#dictdef-publickeycredentialdescriptorjson": {"displayText":"PublicKeyCredentialDescriptorJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialDescriptorJSON","type":"dictionary","url":"#dictdef-publickeycredentialdescriptorjson"},
+"#dictdef-publickeycredentialentity": {"displayText":"PublicKeyCredentialEntity","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialEntity","type":"dictionary","url":"#dictdef-publickeycredentialentity"},
+"#dictdef-publickeycredentialparameters": {"displayText":"PublicKeyCredentialParameters","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialParameters","type":"dictionary","url":"#dictdef-publickeycredentialparameters"},
+"#dictdef-publickeycredentialrequestoptions": {"displayText":"PublicKeyCredentialRequestOptions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRequestOptions","type":"dictionary","url":"#dictdef-publickeycredentialrequestoptions"},
+"#dictdef-publickeycredentialrequestoptionsjson": {"displayText":"PublicKeyCredentialRequestOptionsJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRequestOptionsJSON","type":"dictionary","url":"#dictdef-publickeycredentialrequestoptionsjson"},
+"#dictdef-publickeycredentialrpentity": {"displayText":"PublicKeyCredentialRpEntity","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialRpEntity","type":"dictionary","url":"#dictdef-publickeycredentialrpentity"},
+"#dictdef-publickeycredentialuserentity": {"displayText":"PublicKeyCredentialUserEntity","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialUserEntity","type":"dictionary","url":"#dictdef-publickeycredentialuserentity"},
+"#dictdef-publickeycredentialuserentityjson": {"displayText":"PublicKeyCredentialUserEntityJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialUserEntityJSON","type":"dictionary","url":"#dictdef-publickeycredentialuserentityjson"},
+"#dictdef-registrationresponsejson": {"displayText":"RegistrationResponseJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"RegistrationResponseJSON","type":"dictionary","url":"#dictdef-registrationresponsejson"},
+"#dictdef-unknowncredentialoptions": {"displayText":"UnknownCredentialOptions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"UnknownCredentialOptions","type":"dictionary","url":"#dictdef-unknowncredentialoptions"},
+"#discoverable-credential": {"displayText":"discoverable credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverable credential","type":"dfn","url":"#discoverable-credential"},
+"#discoverable-credential-capable": {"displayText":"discoverable credential capable","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverable credential capable","type":"dfn","url":"#discoverable-credential-capable"},
+"#discoverablecredentialmetadata": {"displayText":"discoverablecredentialmetadata","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discoverablecredentialmetadata","type":"dfn","url":"#discoverablecredentialmetadata"},
+"#discoverablecredentialmetadata-id": {"displayText":"id","export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dfn","url":"#discoverablecredentialmetadata-id"},
+"#discoverablecredentialmetadata-otherui": {"displayText":"otherui","export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"otherui","type":"dfn","url":"#discoverablecredentialmetadata-otherui"},
+"#discoverablecredentialmetadata-type": {"displayText":"type","export":true,"for_":["DiscoverableCredentialMetadata"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dfn","url":"#discoverablecredentialmetadata-type"},
+"#dom-allacceptedcredentialsoptions-allacceptedcredentialids": {"displayText":"allAcceptedCredentialIds","export":true,"for_":["AllAcceptedCredentialsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"allAcceptedCredentialIds","type":"dict-member","url":"#dom-allacceptedcredentialsoptions-allacceptedcredentialids"},
+"#dom-allacceptedcredentialsoptions-rpid": {"displayText":"rpId","export":true,"for_":["AllAcceptedCredentialsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpId","type":"dict-member","url":"#dom-allacceptedcredentialsoptions-rpid"},
+"#dom-allacceptedcredentialsoptions-userid": {"displayText":"userId","export":true,"for_":["AllAcceptedCredentialsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userId","type":"dict-member","url":"#dom-allacceptedcredentialsoptions-userid"},
+"#dom-attestationconveyancepreference-direct": {"displayText":"direct","export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"direct","type":"enum-value","url":"#dom-attestationconveyancepreference-direct"},
+"#dom-attestationconveyancepreference-enterprise": {"displayText":"enterprise","export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"enterprise","type":"enum-value","url":"#dom-attestationconveyancepreference-enterprise"},
+"#dom-attestationconveyancepreference-indirect": {"displayText":"indirect","export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"indirect","type":"enum-value","url":"#dom-attestationconveyancepreference-indirect"},
+"#dom-attestationconveyancepreference-none": {"displayText":"none","export":true,"for_":["AttestationConveyancePreference"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"none","type":"enum-value","url":"#dom-attestationconveyancepreference-none"},
+"#dom-authenticationextensionsclientinputs-appid": {"displayText":"appid","export":true,"for_":["AuthenticationExtensionsClientInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appid","type":"dict-member","url":"#dom-authenticationextensionsclientinputs-appid"},
+"#dom-authenticationextensionsclientinputs-appidexclude": {"displayText":"appidExclude","export":true,"for_":["AuthenticationExtensionsClientInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"appidExclude","type":"dict-member","url":"#dom-authenticationextensionsclientinputs-appidexclude"},
+"#dom-authenticationextensionsclientoutputs-credprops": {"displayText":"credProps","export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credProps","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-credprops"},
+"#dom-authenticationextensionsclientoutputs-largeblob": {"displayText":"largeBlob","export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"largeBlob","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-largeblob"},
+"#dom-authenticationextensionsclientoutputs-prf": {"displayText":"prf","export":true,"for_":["AuthenticationExtensionsClientOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"prf","type":"dict-member","url":"#dom-authenticationextensionsclientoutputs-prf"},
+"#dom-authenticationextensionslargeblobinputs-read": {"displayText":"read","export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"read","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-read"},
+"#dom-authenticationextensionslargeblobinputs-support": {"displayText":"support","export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"support","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-support"},
+"#dom-authenticationextensionslargeblobinputs-write": {"displayText":"write","export":true,"for_":["AuthenticationExtensionsLargeBlobInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"write","type":"dict-member","url":"#dom-authenticationextensionslargeblobinputs-write"},
+"#dom-authenticationextensionslargebloboutputs-blob": {"displayText":"blob","export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"blob","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-blob"},
+"#dom-authenticationextensionslargebloboutputs-supported": {"displayText":"supported","export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"supported","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-supported"},
+"#dom-authenticationextensionslargebloboutputs-written": {"displayText":"written","export":true,"for_":["AuthenticationExtensionsLargeBlobOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"written","type":"dict-member","url":"#dom-authenticationextensionslargebloboutputs-written"},
+"#dom-authenticationextensionsprfinputs-eval": {"displayText":"eval","export":true,"for_":["AuthenticationExtensionsPRFInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"eval","type":"dict-member","url":"#dom-authenticationextensionsprfinputs-eval"},
+"#dom-authenticationextensionsprfinputs-evalbycredential": {"displayText":"evalByCredential","export":true,"for_":["AuthenticationExtensionsPRFInputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"evalByCredential","type":"dict-member","url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
+"#dom-authenticationextensionsprfoutputs-enabled": {"displayText":"enabled","export":true,"for_":["AuthenticationExtensionsPRFOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"enabled","type":"dict-member","url":"#dom-authenticationextensionsprfoutputs-enabled"},
+"#dom-authenticationextensionsprfoutputs-results": {"displayText":"results","export":true,"for_":["AuthenticationExtensionsPRFOutputs"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"results","type":"dict-member","url":"#dom-authenticationextensionsprfoutputs-results"},
+"#dom-authenticationextensionsprfvalues-first": {"displayText":"first","export":true,"for_":["AuthenticationExtensionsPRFValues"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"first","type":"dict-member","url":"#dom-authenticationextensionsprfvalues-first"},
+"#dom-authenticationextensionsprfvalues-second": {"displayText":"second","export":true,"for_":["AuthenticationExtensionsPRFValues"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second","type":"dict-member","url":"#dom-authenticationextensionsprfvalues-second"},
+"#dom-authenticationresponsejson-clientextensionresults": {"displayText":"clientExtensionResults","export":true,"for_":["AuthenticationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientExtensionResults","type":"dict-member","url":"#dom-authenticationresponsejson-clientextensionresults"},
+"#dom-authenticatorassertionresponse-authenticatordata": {"displayText":"authenticatorData","export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorData","type":"attribute","url":"#dom-authenticatorassertionresponse-authenticatordata"},
+"#dom-authenticatorassertionresponse-signature": {"displayText":"signature","export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signature","type":"attribute","url":"#dom-authenticatorassertionresponse-signature"},
+"#dom-authenticatorassertionresponse-userhandle": {"displayText":"userHandle","export":true,"for_":["AuthenticatorAssertionResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userHandle","type":"attribute","url":"#dom-authenticatorassertionresponse-userhandle"},
+"#dom-authenticatorattachment-cross-platform": {"displayText":"\"cross-platform\"","export":true,"for_":["AuthenticatorAttachment"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"cross-platform\"","type":"enum-value","url":"#dom-authenticatorattachment-cross-platform"},
+"#dom-authenticatorattachment-platform": {"displayText":"\"platform\"","export":true,"for_":["AuthenticatorAttachment"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"platform\"","type":"enum-value","url":"#dom-authenticatorattachment-platform"},
+"#dom-authenticatorattestationresponse-attestationobject": {"displayText":"attestationObject","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationObject","type":"attribute","url":"#dom-authenticatorattestationresponse-attestationobject"},
+"#dom-authenticatorattestationresponse-getauthenticatordata": {"displayText":"getAuthenticatorData()","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getAuthenticatorData()","type":"method","url":"#dom-authenticatorattestationresponse-getauthenticatordata"},
+"#dom-authenticatorattestationresponse-getpublickey": {"displayText":"getPublicKey()","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getPublicKey()","type":"method","url":"#dom-authenticatorattestationresponse-getpublickey"},
+"#dom-authenticatorattestationresponse-getpublickeyalgorithm": {"displayText":"getPublicKeyAlgorithm()","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getPublicKeyAlgorithm()","type":"method","url":"#dom-authenticatorattestationresponse-getpublickeyalgorithm"},
+"#dom-authenticatorattestationresponse-gettransports": {"displayText":"getTransports()","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getTransports()","type":"method","url":"#dom-authenticatorattestationresponse-gettransports"},
+"#dom-authenticatorattestationresponse-transports-slot": {"displayText":"[[transports]]","export":true,"for_":["AuthenticatorAttestationResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[transports]]","type":"attribute","url":"#dom-authenticatorattestationresponse-transports-slot"},
+"#dom-authenticatorattestationresponsejson-publickey": {"displayText":"publicKey","export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-publickey"},
+"#dom-authenticatorattestationresponsejson-publickeyalgorithm": {"displayText":"publicKeyAlgorithm","export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKeyAlgorithm","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-publickeyalgorithm"},
+"#dom-authenticatorattestationresponsejson-transports": {"displayText":"transports","export":true,"for_":["AuthenticatorAttestationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"dict-member","url":"#dom-authenticatorattestationresponsejson-transports"},
+"#dom-authenticatorresponse-clientdatajson": {"displayText":"clientDataJSON","export":true,"for_":["AuthenticatorResponse"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientDataJSON","type":"attribute","url":"#dom-authenticatorresponse-clientdatajson"},
+"#dom-authenticatorselectioncriteria-authenticatorattachment": {"displayText":"authenticatorAttachment","export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorAttachment","type":"dict-member","url":"#dom-authenticatorselectioncriteria-authenticatorattachment"},
+"#dom-authenticatorselectioncriteria-requireresidentkey": {"displayText":"requireResidentKey","export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"requireResidentKey","type":"dict-member","url":"#dom-authenticatorselectioncriteria-requireresidentkey"},
+"#dom-authenticatorselectioncriteria-residentkey": {"displayText":"residentKey","export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"residentKey","type":"dict-member","url":"#dom-authenticatorselectioncriteria-residentkey"},
+"#dom-authenticatorselectioncriteria-userverification": {"displayText":"userVerification","export":true,"for_":["AuthenticatorSelectionCriteria"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userVerification","type":"dict-member","url":"#dom-authenticatorselectioncriteria-userverification"},
+"#dom-authenticatortransport-ble": {"displayText":"\"ble\"","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"ble\"","type":"enum-value","url":"#dom-authenticatortransport-ble"},
+"#dom-authenticatortransport-hybrid": {"displayText":"hybrid","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hybrid","type":"enum-value","url":"#dom-authenticatortransport-hybrid"},
+"#dom-authenticatortransport-internal": {"displayText":"internal","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"internal","type":"enum-value","url":"#dom-authenticatortransport-internal"},
+"#dom-authenticatortransport-nfc": {"displayText":"\"nfc\"","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"nfc\"","type":"enum-value","url":"#dom-authenticatortransport-nfc"},
+"#dom-authenticatortransport-smart-card": {"displayText":"\"smart-card\"","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"smart-card\"","type":"enum-value","url":"#dom-authenticatortransport-smart-card"},
+"#dom-authenticatortransport-usb": {"displayText":"\"usb\"","export":true,"for_":["AuthenticatorTransport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"usb\"","type":"enum-value","url":"#dom-authenticatortransport-usb"},
+"#dom-clientcapability-conditionalcreate": {"displayText":"conditionalCreate","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"conditionalCreate","type":"enum-value","url":"#dom-clientcapability-conditionalcreate"},
+"#dom-clientcapability-conditionalget": {"displayText":"conditionalGet","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"conditionalGet","type":"enum-value","url":"#dom-clientcapability-conditionalget"},
+"#dom-clientcapability-hybridtransport": {"displayText":"\"hybridTransport\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"hybridTransport\"","type":"enum-value","url":"#dom-clientcapability-hybridtransport"},
+"#dom-clientcapability-passkeyplatformauthenticator": {"displayText":"\"passkeyPlatformAuthenticator\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"passkeyPlatformAuthenticator\"","type":"enum-value","url":"#dom-clientcapability-passkeyplatformauthenticator"},
+"#dom-clientcapability-relatedorigins": {"displayText":"\"relatedOrigins\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"relatedOrigins\"","type":"enum-value","url":"#dom-clientcapability-relatedorigins"},
+"#dom-clientcapability-signalallacceptedcredentials": {"displayText":"\"signalAllAcceptedCredentials\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"signalAllAcceptedCredentials\"","type":"enum-value","url":"#dom-clientcapability-signalallacceptedcredentials"},
+"#dom-clientcapability-signalcurrentuserdetails": {"displayText":"\"signalCurrentUserDetails\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"signalCurrentUserDetails\"","type":"enum-value","url":"#dom-clientcapability-signalcurrentuserdetails"},
+"#dom-clientcapability-signalunknowncredential": {"displayText":"\"signalUnknownCredential\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"signalUnknownCredential\"","type":"enum-value","url":"#dom-clientcapability-signalunknowncredential"},
+"#dom-clientcapability-userverifyingplatformauthenticator": {"displayText":"\"userVerifyingPlatformAuthenticator\"","export":true,"for_":["ClientCapability"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"userVerifyingPlatformAuthenticator\"","type":"enum-value","url":"#dom-clientcapability-userverifyingplatformauthenticator"},
+"#dom-collectedclientdata-challenge": {"displayText":"challenge","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-collectedclientdata-challenge"},
+"#dom-collectedclientdata-crossorigin": {"displayText":"crossOrigin","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"crossOrigin","type":"dict-member","url":"#dom-collectedclientdata-crossorigin"},
+"#dom-collectedclientdata-origin": {"displayText":"origin","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"dict-member","url":"#dom-collectedclientdata-origin"},
+"#dom-collectedclientdata-tokenbinding": {"displayText":"tokenbinding","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"tokenbinding","type":"dfn","url":"#dom-collectedclientdata-tokenbinding"},
+"#dom-collectedclientdata-toporigin": {"displayText":"topOrigin","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"topOrigin","type":"dict-member","url":"#dom-collectedclientdata-toporigin"},
+"#dom-collectedclientdata-type": {"displayText":"type","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-collectedclientdata-type"},
+"#dom-credentialcreationoptions-publickey": {"displayText":"publicKey","export":true,"for_":["CredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialcreationoptions-publickey"},
+"#dom-credentialpropertiesoutput-rk": {"displayText":"rk","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rk","type":"dict-member","url":"#dom-credentialpropertiesoutput-rk"},
+"#dom-credentialrequestoptions-publickey": {"displayText":"publicKey","export":true,"for_":["CredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialrequestoptions-publickey"},
+"#dom-currentuserdetailsoptions-displayname": {"displayText":"displayName","export":true,"for_":["CurrentUserDetailsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"displayName","type":"dict-member","url":"#dom-currentuserdetailsoptions-displayname"},
+"#dom-currentuserdetailsoptions-name": {"displayText":"name","export":true,"for_":["CurrentUserDetailsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"name","type":"dict-member","url":"#dom-currentuserdetailsoptions-name"},
+"#dom-currentuserdetailsoptions-rpid": {"displayText":"rpId","export":true,"for_":["CurrentUserDetailsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpId","type":"dict-member","url":"#dom-currentuserdetailsoptions-rpid"},
+"#dom-currentuserdetailsoptions-userid": {"displayText":"userId","export":true,"for_":["CurrentUserDetailsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userId","type":"dict-member","url":"#dom-currentuserdetailsoptions-userid"},
+"#dom-largeblobsupport-preferred": {"displayText":"\"preferred\"","export":true,"for_":["LargeBlobSupport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"preferred\"","type":"enum-value","url":"#dom-largeblobsupport-preferred"},
+"#dom-largeblobsupport-required": {"displayText":"\"required\"","export":true,"for_":["LargeBlobSupport"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"required\"","type":"enum-value","url":"#dom-largeblobsupport-required"},
+"#dom-publickeycredential-authenticatorattachment": {"displayText":"authenticatorAttachment","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorAttachment","type":"attribute","url":"#dom-publickeycredential-authenticatorattachment"},
+"#dom-publickeycredential-clientextensionsresults-slot": {"displayText":"[[clientExtensionsResults]]","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[clientExtensionsResults]]","type":"attribute","url":"#dom-publickeycredential-clientextensionsresults-slot"},
+"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin": {"displayText":"origin","export":true,"for_":["PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"argument","url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin"},
+"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"displayText":"sameOriginWithAncestors","export":true,"for_":["PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"sameOriginWithAncestors","type":"argument","url":"#dom-publickeycredential-create-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
+"#dom-publickeycredential-create-slot": {"displayText":"[[Create]](origin, options, sameOriginWithAncestors)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[Create]](origin, options, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-create-slot"},
+"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin": {"displayText":"origin","export":true,"for_":["PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"origin","type":"argument","url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"},
+"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors": {"displayText":"sameOriginWithAncestors","export":true,"for_":["PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"sameOriginWithAncestors","type":"argument","url":"#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors"},
+"#dom-publickeycredential-discoverfromexternalsource-slot": {"displayText":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-discoverfromexternalsource-slot"},
+"#dom-publickeycredential-getclientcapabilities": {"displayText":"getClientCapabilities()","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getClientCapabilities()","type":"method","url":"#dom-publickeycredential-getclientcapabilities"},
+"#dom-publickeycredential-getclientextensionresults": {"displayText":"getClientExtensionResults()","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"getClientExtensionResults()","type":"method","url":"#dom-publickeycredential-getclientextensionresults"},
+"#dom-publickeycredential-identifier-slot": {"displayText":"[[identifier]]","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[identifier]]","type":"attribute","url":"#dom-publickeycredential-identifier-slot"},
+"#dom-publickeycredential-isconditionalmediationavailable": {"displayText":"isConditionalMediationAvailable()","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"isConditionalMediationAvailable()","type":"method","url":"#dom-publickeycredential-isconditionalmediationavailable"},
+"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable": {"displayText":"isUserVerifyingPlatformAuthenticatorAvailable()","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"isUserVerifyingPlatformAuthenticatorAvailable()","type":"method","url":"#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"},
+"#dom-publickeycredential-parsecreationoptionsfromjson-options-options": {"displayText":"options","export":true,"for_":["PublicKeyCredential/parseCreationOptionsFromJSON(options)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"options","type":"argument","url":"#dom-publickeycredential-parsecreationoptionsfromjson-options-options"},
+"#dom-publickeycredential-parserequestoptionsfromjson-options-options": {"displayText":"options","export":true,"for_":["PublicKeyCredential/parseRequestOptionsFromJSON(options)"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"options","type":"argument","url":"#dom-publickeycredential-parserequestoptionsfromjson-options-options"},
+"#dom-publickeycredential-rawid": {"displayText":"rawId","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rawId","type":"attribute","url":"#dom-publickeycredential-rawid"},
+"#dom-publickeycredential-response": {"displayText":"response","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"response","type":"attribute","url":"#dom-publickeycredential-response"},
+"#dom-publickeycredential-signalallacceptedcredentials": {"displayText":"signalAllAcceptedCredentials(options)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signalAllAcceptedCredentials(options)","type":"method","url":"#dom-publickeycredential-signalallacceptedcredentials"},
+"#dom-publickeycredential-signalcurrentuserdetails": {"displayText":"signalCurrentUserDetails(options)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signalCurrentUserDetails(options)","type":"method","url":"#dom-publickeycredential-signalcurrentuserdetails"},
+"#dom-publickeycredential-signalunknowncredential": {"displayText":"signalUnknownCredential(options)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signalUnknownCredential(options)","type":"method","url":"#dom-publickeycredential-signalunknowncredential"},
+"#dom-publickeycredential-store-slot": {"displayText":"[[Store]](credential, sameOriginWithAncestors)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"[[Store]](credential, sameOriginWithAncestors)","type":"method","url":"#dom-publickeycredential-store-slot"},
+"#dom-publickeycredential-tojson": {"displayText":"toJSON()","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"toJSON()","type":"method","url":"#dom-publickeycredential-tojson"},
+"#dom-publickeycredentialcreationoptions-attestation": {"displayText":"attestation","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestation","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-attestation"},
+"#dom-publickeycredentialcreationoptions-attestationformats": {"displayText":"attestationFormats","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationFormats","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-attestationformats"},
+"#dom-publickeycredentialcreationoptions-authenticatorselection": {"displayText":"authenticatorSelection","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorSelection","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-authenticatorselection"},
+"#dom-publickeycredentialcreationoptions-challenge": {"displayText":"challenge","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-challenge"},
+"#dom-publickeycredentialcreationoptions-excludecredentials": {"displayText":"excludeCredentials","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"excludeCredentials","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
+"#dom-publickeycredentialcreationoptions-extensions": {"displayText":"extensions","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-extensions"},
+"#dom-publickeycredentialcreationoptions-hints": {"displayText":"hints","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hints","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-hints"},
+"#dom-publickeycredentialcreationoptions-pubkeycredparams": {"displayText":"pubKeyCredParams","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"pubKeyCredParams","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
+"#dom-publickeycredentialcreationoptions-rp": {"displayText":"rp","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rp","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-rp"},
+"#dom-publickeycredentialcreationoptions-timeout": {"displayText":"timeout","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"timeout","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-timeout"},
+"#dom-publickeycredentialcreationoptions-user": {"displayText":"user","export":true,"for_":["PublicKeyCredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user","type":"dict-member","url":"#dom-publickeycredentialcreationoptions-user"},
+"#dom-publickeycredentialdescriptor-id": {"displayText":"id","export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialdescriptor-id"},
+"#dom-publickeycredentialdescriptor-transports": {"displayText":"transports","export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"transports","type":"dict-member","url":"#dom-publickeycredentialdescriptor-transports"},
+"#dom-publickeycredentialdescriptor-type": {"displayText":"type","export":true,"for_":["PublicKeyCredentialDescriptor"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-publickeycredentialdescriptor-type"},
+"#dom-publickeycredentialentity-name": {"displayText":"name","export":true,"for_":["PublicKeyCredentialEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"name","type":"dict-member","url":"#dom-publickeycredentialentity-name"},
+"#dom-publickeycredentialhint-client-device": {"displayText":"\"client-device\"","export":true,"for_":["PublicKeyCredentialHint"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"client-device\"","type":"enum-value","url":"#dom-publickeycredentialhint-client-device"},
+"#dom-publickeycredentialhint-hybrid": {"displayText":"\"hybrid\"","export":true,"for_":["PublicKeyCredentialHint"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"hybrid\"","type":"enum-value","url":"#dom-publickeycredentialhint-hybrid"},
+"#dom-publickeycredentialhint-security-key": {"displayText":"\"security-key\"","export":true,"for_":["PublicKeyCredentialHint"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"security-key\"","type":"enum-value","url":"#dom-publickeycredentialhint-security-key"},
+"#dom-publickeycredentialparameters-alg": {"displayText":"alg","export":true,"for_":["PublicKeyCredentialParameters"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"alg","type":"dict-member","url":"#dom-publickeycredentialparameters-alg"},
+"#dom-publickeycredentialparameters-type": {"displayText":"type","export":true,"for_":["PublicKeyCredentialParameters"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-publickeycredentialparameters-type"},
+"#dom-publickeycredentialrequestoptions-allowcredentials": {"displayText":"allowCredentials","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"allowCredentials","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-allowcredentials"},
+"#dom-publickeycredentialrequestoptions-challenge": {"displayText":"challenge","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"challenge","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-challenge"},
+"#dom-publickeycredentialrequestoptions-extensions": {"displayText":"extensions","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extensions","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-extensions"},
+"#dom-publickeycredentialrequestoptions-hints": {"displayText":"hints","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"hints","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-hints"},
+"#dom-publickeycredentialrequestoptions-rpid": {"displayText":"rpId","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpId","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-rpid"},
+"#dom-publickeycredentialrequestoptions-timeout": {"displayText":"timeout","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"timeout","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-timeout"},
+"#dom-publickeycredentialrequestoptions-userverification": {"displayText":"userVerification","export":true,"for_":["PublicKeyCredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userVerification","type":"dict-member","url":"#dom-publickeycredentialrequestoptions-userverification"},
+"#dom-publickeycredentialrpentity-id": {"displayText":"id","export":true,"for_":["PublicKeyCredentialRpEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialrpentity-id"},
+"#dom-publickeycredentialtype-public-key": {"displayText":"public-key","export":true,"for_":["PublicKeyCredentialType"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public-key","type":"enum-value","url":"#dom-publickeycredentialtype-public-key"},
+"#dom-publickeycredentialuserentity-displayname": {"displayText":"displayName","export":true,"for_":["PublicKeyCredentialUserEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"displayName","type":"dict-member","url":"#dom-publickeycredentialuserentity-displayname"},
+"#dom-publickeycredentialuserentity-id": {"displayText":"id","export":true,"for_":["PublicKeyCredentialUserEntity"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-publickeycredentialuserentity-id"},
+"#dom-registrationresponsejson-clientextensionresults": {"displayText":"clientExtensionResults","export":true,"for_":["RegistrationResponseJSON"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientExtensionResults","type":"dict-member","url":"#dom-registrationresponsejson-clientextensionresults"},
+"#dom-residentkeyrequirement-discouraged": {"displayText":"discouraged","export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discouraged","type":"enum-value","url":"#dom-residentkeyrequirement-discouraged"},
+"#dom-residentkeyrequirement-preferred": {"displayText":"preferred","export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"preferred","type":"enum-value","url":"#dom-residentkeyrequirement-preferred"},
+"#dom-residentkeyrequirement-required": {"displayText":"required","export":true,"for_":["ResidentKeyRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"required","type":"enum-value","url":"#dom-residentkeyrequirement-required"},
+"#dom-tokenbinding-id": {"displayText":"id","export":true,"for_":["TokenBinding"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dict-member","url":"#dom-tokenbinding-id"},
+"#dom-tokenbinding-status": {"displayText":"status","export":true,"for_":["TokenBinding"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"status","type":"dict-member","url":"#dom-tokenbinding-status"},
+"#dom-tokenbindingstatus-present": {"displayText":"\"present\"","export":true,"for_":["TokenBindingStatus"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"present\"","type":"enum-value","url":"#dom-tokenbindingstatus-present"},
+"#dom-tokenbindingstatus-supported": {"displayText":"\"supported\"","export":true,"for_":["TokenBindingStatus"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"\"supported\"","type":"enum-value","url":"#dom-tokenbindingstatus-supported"},
+"#dom-unknowncredentialoptions-credentialid": {"displayText":"credentialId","export":true,"for_":["UnknownCredentialOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credentialId","type":"dict-member","url":"#dom-unknowncredentialoptions-credentialid"},
+"#dom-unknowncredentialoptions-rpid": {"displayText":"rpId","export":true,"for_":["UnknownCredentialOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpId","type":"dict-member","url":"#dom-unknowncredentialoptions-rpid"},
+"#dom-userverificationrequirement-discouraged": {"displayText":"discouraged","export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"discouraged","type":"enum-value","url":"#dom-userverificationrequirement-discouraged"},
+"#dom-userverificationrequirement-preferred": {"displayText":"preferred","export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"preferred","type":"enum-value","url":"#dom-userverificationrequirement-preferred"},
+"#dom-userverificationrequirement-required": {"displayText":"required","export":true,"for_":["UserVerificationRequirement"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"required","type":"enum-value","url":"#dom-userverificationrequirement-required"},
+"#effective-resident-key-requirement-for-credential-creation": {"displayText":"effective resident key requirement for credential creation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective resident key requirement for credential creation","type":"dfn","url":"#effective-resident-key-requirement-for-credential-creation"},
+"#effective-user-verification-requirement-for-assertion": {"displayText":"effective user verification requirement for assertion","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective user verification requirement for assertion","type":"dfn","url":"#effective-user-verification-requirement-for-assertion"},
+"#effective-user-verification-requirement-for-credential-creation": {"displayText":"effective user verification requirement for credential creation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"effective user verification requirement for credential creation","type":"dfn","url":"#effective-user-verification-requirement-for-credential-creation"},
+"#enumdef-attestationconveyancepreference": {"displayText":"AttestationConveyancePreference","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AttestationConveyancePreference","type":"enum","url":"#enumdef-attestationconveyancepreference"},
+"#enumdef-authenticatorattachment": {"displayText":"AuthenticatorAttachment","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorAttachment","type":"enum","url":"#enumdef-authenticatorattachment"},
+"#enumdef-authenticatortransport": {"displayText":"AuthenticatorTransport","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"AuthenticatorTransport","type":"enum","url":"#enumdef-authenticatortransport"},
+"#enumdef-clientcapability": {"displayText":"ClientCapability","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ClientCapability","type":"enum","url":"#enumdef-clientcapability"},
+"#enumdef-largeblobsupport": {"displayText":"LargeBlobSupport","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"LargeBlobSupport","type":"enum","url":"#enumdef-largeblobsupport"},
+"#enumdef-publickeycredentialhint": {"displayText":"PublicKeyCredentialHint","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialHint","type":"enum","url":"#enumdef-publickeycredentialhint"},
+"#enumdef-publickeycredentialtype": {"displayText":"PublicKeyCredentialType","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialType","type":"enum","url":"#enumdef-publickeycredentialtype"},
+"#enumdef-residentkeyrequirement": {"displayText":"ResidentKeyRequirement","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ResidentKeyRequirement","type":"enum","url":"#enumdef-residentkeyrequirement"},
+"#enumdef-tokenbindingstatus": {"displayText":"TokenBindingStatus","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"TokenBindingStatus","type":"enum","url":"#enumdef-tokenbindingstatus"},
+"#enumdef-userverificationrequirement": {"displayText":"UserVerificationRequirement","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"UserVerificationRequirement","type":"enum","url":"#enumdef-userverificationrequirement"},
+"#extension-identifier": {"displayText":"extension identifier","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"extension identifier","type":"dfn","url":"#extension-identifier"},
+"#generating-authenticator": {"displayText":"generating authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"generating authenticator","type":"dfn","url":"#generating-authenticator"},
+"#get-credentials": {"displayText":"get credentials","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"get credentials","type":"dfn","url":"#get-credentials"},
+"#human-palatability": {"displayText":"human-palatable","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"human-palatable","type":"dfn","url":"#human-palatability"},
+"#largeblob": {"displayText":"largeblob","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"largeblob","type":"dfn","url":"#largeblob"},
+"#multi-device-credential": {"displayText":"multi-device credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"multi-device credential","type":"dfn","url":"#multi-device-credential"},
+"#multi-factor-capable": {"displayText":"multi-factor capable","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"multi-factor capable","type":"dfn","url":"#multi-factor-capable"},
+"#non-discoverable-credential": {"displayText":"non-discoverable credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"non-discoverable credential","type":"dfn","url":"#non-discoverable-credential"},
+"#non-resident-credential": {"displayText":"non-resident credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"non-resident credential","type":"dfn","url":"#non-resident-credential"},
+"#none": {"displayText":"none","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"none","type":"dfn","url":"#none"},
+"#passkey": {"displayText":"passkey","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"passkey","type":"dfn","url":"#passkey"},
+"#passkey-platform-authenticator": {"displayText":"passkey platform authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"passkey platform authenticator","type":"dfn","url":"#passkey-platform-authenticator"},
+"#passkey-roaming-authenticator": {"displayText":"passkey roaming authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"passkey roaming authenticator","type":"dfn","url":"#passkey-roaming-authenticator"},
+"#platform-attachment": {"displayText":"platform attachment","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform attachment","type":"dfn","url":"#platform-attachment"},
+"#platform-authenticators": {"displayText":"platform authenticators","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform authenticators","type":"dfn","url":"#platform-authenticators"},
+"#platform-credential": {"displayText":"platform credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"platform credential","type":"dfn","url":"#platform-credential"},
+"#prf": {"displayText":"prf","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"prf","type":"dfn","url":"#prf"},
+"#public-key-credential": {"displayText":"public key credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public key credential","type":"dfn","url":"#public-key-credential"},
+"#public-key-credential-source": {"displayText":"public key credential source","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"public key credential source","type":"dfn","url":"#public-key-credential-source"},
+"#public-key-credential-source-id": {"displayText":"id","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"dfn","url":"#public-key-credential-source-id"},
+"#public-key-credential-source-managing-authenticator": {"displayText":"managing authenticator","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"managing authenticator","type":"dfn","url":"#public-key-credential-source-managing-authenticator"},
+"#public-key-credential-source-mutable-item": {"displayText":"mutable item","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"mutable item","type":"dfn","url":"#public-key-credential-source-mutable-item"},
+"#public-key-credential-source-otherui": {"displayText":"otherui","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"otherui","type":"dfn","url":"#public-key-credential-source-otherui"},
+"#public-key-credential-source-privatekey": {"displayText":"privatekey","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"privatekey","type":"dfn","url":"#public-key-credential-source-privatekey"},
+"#public-key-credential-source-rpid": {"displayText":"rpid","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rpid","type":"dfn","url":"#public-key-credential-source-rpid"},
+"#public-key-credential-source-type": {"displayText":"type","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dfn","url":"#public-key-credential-source-type"},
+"#public-key-credential-source-userhandle": {"displayText":"userhandle","export":true,"for_":["public key credential source"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"userhandle","type":"dfn","url":"#public-key-credential-source-userhandle"},
+"#publickey-credentials-get-feature": {"displayText":"publickey-credentials-get-feature","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publickey-credentials-get-feature","type":"dfn","url":"#publickey-credentials-get-feature"},
+"#publickeycredential": {"displayText":"PublicKeyCredential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredential","type":"interface","url":"#publickeycredential"},
+"#publickeycredential-issuing-a-credential-request-to-an-authenticator": {"displayText":"issuing a credential request to an authenticator","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"issuing a credential request to an authenticator","type":"dfn","url":"#publickeycredential-issuing-a-credential-request-to-an-authenticator"},
+"#rate-limiting": {"displayText":"rate limiting","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rate limiting","type":"dfn","url":"#rate-limiting"},
+"#recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"displayText":"recommended range and default for a webauthn ceremony timeout","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"recommended range and default for a webauthn ceremony timeout","type":"dfn","url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
+"#registrable-origin-label": {"displayText":"registrable origin label","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registrable origin label","type":"dfn","url":"#registrable-origin-label"},
+"#registration": {"displayText":"registration","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration","type":"dfn","url":"#registration"},
+"#registration-ceremony": {"displayText":"registration ceremony","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration ceremony","type":"dfn","url":"#registration-ceremony"},
+"#registration-extension": {"displayText":"registration extension","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"registration extension","type":"dfn","url":"#registration-extension"},
+"#relying-party": {"displayText":"relying party","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"relying party","type":"dfn","url":"#relying-party"},
+"#relying-party-identifier": {"displayText":"relying party identifier","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"relying party identifier","type":"dfn","url":"#relying-party-identifier"},
+"#remove-all-credentials": {"displayText":"remove all credentials","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove all credentials","type":"dfn","url":"#remove-all-credentials"},
+"#remove-credential": {"displayText":"remove credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove credential","type":"dfn","url":"#remove-credential"},
+"#remove-virtual-authenticator": {"displayText":"remove virtual authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"remove virtual authenticator","type":"dfn","url":"#remove-virtual-authenticator"},
+"#resident-credential": {"displayText":"resident credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident credential","type":"dfn","url":"#resident-credential"},
+"#resident-key": {"displayText":"resident key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident key","type":"dfn","url":"#resident-key"},
+"#roaming-authenticators": {"displayText":"roaming authenticators","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"roaming authenticators","type":"dfn","url":"#roaming-authenticators"},
+"#roaming-credential": {"displayText":"roaming credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"roaming credential","type":"dfn","url":"#roaming-credential"},
+"#rp-id": {"displayText":"rp id","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rp id","type":"dfn","url":"#rp-id"},
+"#scope": {"displayText":"scope","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"scope","type":"dfn","url":"#scope"},
+"#second-factor-platform-authenticator": {"displayText":"second-factor platform authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second-factor platform authenticator","type":"dfn","url":"#second-factor-platform-authenticator"},
+"#second-factor-roaming-authenticator": {"displayText":"second-factor roaming authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"second-factor roaming authenticator","type":"dfn","url":"#second-factor-roaming-authenticator"},
+"#self": {"displayText":"self","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"self","type":"dfn","url":"#self"},
+"#self-attestation": {"displayText":"self attestation","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"self attestation","type":"dfn","url":"#self-attestation"},
+"#server-side-credential": {"displayText":"server-side credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side credential","type":"dfn","url":"#server-side-credential"},
+"#server-side-credential-storage-modality": {"displayText":"server-side credential storage modality","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side credential storage modality","type":"dfn","url":"#server-side-credential-storage-modality"},
+"#server-side-public-key-credential-source": {"displayText":"server-side public key credential source","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"server-side public key credential source","type":"dfn","url":"#server-side-public-key-credential-source"},
+"#set-credential-properties": {"displayText":"set credential properties","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set credential properties","type":"dfn","url":"#set-credential-properties"},
+"#set-credential-properties-parameters": {"displayText":"set credential properties parameters","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set credential properties parameters","type":"dfn","url":"#set-credential-properties-parameters"},
+"#set-user-verified": {"displayText":"set user verified","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"set user verified","type":"dfn","url":"#set-user-verified"},
+"#signal-method-authenticator-action-unknowncredentialid": {"displayText":"unknowncredentialid","export":true,"for_":["signal method/authenticator action"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"unknowncredentialid","type":"dfn","url":"#signal-method-authenticator-action-unknowncredentialid"},
+"#signal-method-authenticator-actions": {"displayText":"authenticator actions","export":true,"for_":["signal method"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticator actions","type":"dfn","url":"#signal-method-authenticator-actions"},
+"#signal-method-authenticator-actions-allacceptedcredentialids": {"displayText":"allacceptedcredentialids","export":true,"for_":["signal method/authenticator actions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"allacceptedcredentialids","type":"dfn","url":"#signal-method-authenticator-actions-allacceptedcredentialids"},
+"#signal-method-authenticator-actions-currentuserdetails": {"displayText":"currentuserdetails","export":true,"for_":["signal method/authenticator actions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"currentuserdetails","type":"dfn","url":"#signal-method-authenticator-actions-currentuserdetails"},
+"#signal-methods": {"displayText":"signal methods","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signal methods","type":"dfn","url":"#signal-methods"},
+"#signature-counter": {"displayText":"signature counter","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signature counter","type":"dfn","url":"#signature-counter"},
+"#signing-procedure": {"displayText":"signing procedure","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"signing procedure","type":"dfn","url":"#signing-procedure"},
+"#silentcredentialdiscovery": {"displayText":"silentcredentialdiscovery","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"silentcredentialdiscovery","type":"dfn","url":"#silentcredentialdiscovery"},
+"#single-device-credential": {"displayText":"single-device credential","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"single-device credential","type":"dfn","url":"#single-device-credential"},
+"#single-factor-capable": {"displayText":"single-factor capable","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"single-factor capable","type":"dfn","url":"#single-factor-capable"},
+"#test-of-user-presence": {"displayText":"test of user presence","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"test of user presence","type":"dfn","url":"#test-of-user-presence"},
+"#typedefdef-base64urlstring": {"displayText":"Base64URLString","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"Base64URLString","type":"typedef","url":"#typedefdef-base64urlstring"},
+"#typedefdef-cosealgorithmidentifier": {"displayText":"COSEAlgorithmIdentifier","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"COSEAlgorithmIdentifier","type":"typedef","url":"#typedefdef-cosealgorithmidentifier"},
+"#typedefdef-publickeycredentialclientcapabilities": {"displayText":"PublicKeyCredentialClientCapabilities","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialClientCapabilities","type":"typedef","url":"#typedefdef-publickeycredentialclientcapabilities"},
+"#typedefdef-publickeycredentialjson": {"displayText":"PublicKeyCredentialJSON","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"PublicKeyCredentialJSON","type":"typedef","url":"#typedefdef-publickeycredentialjson"},
+"#ui-redressing": {"displayText":"ui redressing","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"ui redressing","type":"dfn","url":"#ui-redressing"},
+"#unsigned-extension-outputs": {"displayText":"unsigned extension outputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"unsigned extension outputs","type":"dfn","url":"#unsigned-extension-outputs"},
+"#user-account": {"displayText":"user account","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user account","type":"dfn","url":"#user-account"},
+"#user-consent": {"displayText":"user consent","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user consent","type":"dfn","url":"#user-consent"},
+"#user-handle": {"displayText":"user handle","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user handle","type":"dfn","url":"#user-handle"},
+"#user-public-key": {"displayText":"user public key","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user public key","type":"dfn","url":"#user-public-key"},
+"#user-verification": {"displayText":"user verification","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user verification","type":"dfn","url":"#user-verification"},
+"#user-verifying-platform-authenticator": {"displayText":"user-verifying platform authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"user-verifying platform authenticator","type":"dfn","url":"#user-verifying-platform-authenticator"},
+"#verification-procedure": {"displayText":"verification procedure","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"verification procedure","type":"dfn","url":"#verification-procedure"},
+"#verification-procedure-inputs": {"displayText":"verification procedure inputs","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"verification procedure inputs","type":"dfn","url":"#verification-procedure-inputs"},
+"#virtual-authenticator-database": {"displayText":"virtual authenticator database","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"virtual authenticator database","type":"dfn","url":"#virtual-authenticator-database"},
+"#virtual-authenticators": {"displayText":"virtual authenticators","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"virtual authenticators","type":"dfn","url":"#virtual-authenticators"},
+"#web-application": {"displayText":"web application","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"web application","type":"dfn","url":"#web-application"},
+"#web-authentication-api": {"displayText":"web authentication api","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"web authentication api","type":"dfn","url":"#web-authentication-api"},
+"#webauthn-authenticator": {"displayText":"webauthn authenticator","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn authenticator","type":"dfn","url":"#webauthn-authenticator"},
+"#webauthn-client": {"displayText":"webauthn client","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn client","type":"dfn","url":"#webauthn-client"},
+"#webauthn-client-device": {"displayText":"webauthn client device","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn client device","type":"dfn","url":"#webauthn-client-device"},
+"#webauthn-extensions": {"displayText":"webauthn extensions","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn extensions","type":"dfn","url":"#webauthn-extensions"},
+"#webauthn-relying-party": {"displayText":"webauthn relying party","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn relying party","type":"dfn","url":"#webauthn-relying-party"},
+"#webauthn-signature": {"displayText":"webauthn signature","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"webauthn signature","type":"dfn","url":"#webauthn-signature"},
+"https://dom.spec.whatwg.org/#abortcontroller": {"displayText":"AbortController","export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"AbortController","type":"interface","url":"https://dom.spec.whatwg.org/#abortcontroller"},
+"https://dom.spec.whatwg.org/#abortsignal": {"displayText":"AbortSignal","export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"AbortSignal","type":"interface","url":"https://dom.spec.whatwg.org/#abortsignal"},
+"https://dom.spec.whatwg.org/#abortsignal-abort-reason": {"displayText":"abort reason","export":true,"for_":["AbortSignal"],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"abort reason","type":"dfn","url":"https://dom.spec.whatwg.org/#abortsignal-abort-reason"},
+"https://dom.spec.whatwg.org/#abortsignal-aborted": {"displayText":"aborted","export":true,"for_":["AbortSignal"],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"aborted","type":"dfn","url":"https://dom.spec.whatwg.org/#abortsignal-aborted"},
+"https://dom.spec.whatwg.org/#clone-a-node-document": {"displayText":"document","export":true,"for_":["clone a node"],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"document","type":"dfn","url":"https://dom.spec.whatwg.org/#clone-a-node-document"},
+"https://dom.spec.whatwg.org/#document": {"displayText":"Document","export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"Document","type":"interface","url":"https://dom.spec.whatwg.org/#document"},
+"https://encoding.spec.whatwg.org/#utf-8-decode": {"displayText":"UTF-8 decode","export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 decode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
+"https://encoding.spec.whatwg.org/#utf-8-encode": {"displayText":"UTF-8 encode","export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 encode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
+"https://fetch.spec.whatwg.org/#concept-request-credentials-mode": {"displayText":"credentials mode","export":true,"for_":["request"],"level":"1","normative":true,"shortname":"fetch","spec":"fetch","status":"current","text":"credentials mode","type":"dfn","url":"https://fetch.spec.whatwg.org/#concept-request-credentials-mode"},
+"https://fetch.spec.whatwg.org/#concept-request-referrer-policy": {"displayText":"referrer policy","export":true,"for_":["request"],"level":"1","normative":true,"shortname":"fetch","spec":"fetch","status":"current","text":"referrer policy","type":"dfn","url":"https://fetch.spec.whatwg.org/#concept-request-referrer-policy"},
+"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats": {"displayText":"Section 3.6.2 Public Key Representation Formats","export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.6.2 public key representation formats","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats"},
+"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate": {"displayText":"application parameter","export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"application parameter","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate"},
+"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success": {"displayText":"Section 5.4","export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"section 5.4","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},
+"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success": {"displayText":"Section 4.3","export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"section 4.3","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success"},
+"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid": {"displayText":"determining if a caller's FacetID is authorized for an AppID","export":true,"for_":[],"level":"","normative":true,"shortname":"fido-appid","spec":"fido-appid","status":"anchor-block","text":"determining if a caller's facetid is authorized for an appid","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid"},
+"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application": {"displayText":"determining the FacetID of a calling application","export":true,"for_":[],"level":"","normative":true,"shortname":"fido-appid","spec":"fido-appid","status":"anchor-block","text":"determining the facetid of a calling application","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application"},
+"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api": {"displayText":"\u00a76. Authenticator API","export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"\u00a76. authenticator api","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
+"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs": {"displayText":"large, per-credential blobs","export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"large, per-credential blobs","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs"},
+"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form": {"displayText":"CTAP2 canonical CBOR encoding form","export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"ctap2 canonical cbor encoding form","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
+"https://html.spec.whatwg.org/#focus": {"displayText":"focus","export":true,"for_":[],"level":"","normative":true,"shortname":"whatwg html","spec":"whatwg html","status":"anchor-block","text":"focus","type":"dfn","url":"https://html.spec.whatwg.org/#focus"},
+"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin": {"displayText":"ASCII serialization of an origin","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"ascii serialization of an origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin"},
+"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context": {"displayText":"browsing context","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"browsing context","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
+"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain": {"displayText":"effective domain","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"effective domain","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
+"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host": {"displayText":"host","export":true,"for_":["origin"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"host","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host"},
+"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme": {"displayText":"scheme","export":true,"for_":["origin"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"scheme","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme"},
+"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to": {"displayText":"is a registrable domain suffix of or is equal to","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"is a registrable domain suffix of or is equal to","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
+"https://html.spec.whatwg.org/multipage/browsers.html#same-origin": {"displayText":"same origin","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"same origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#same-origin"},
+"https://html.spec.whatwg.org/multipage/browsers.html#same-site": {"displayText":"same site","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"same site","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
+"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy": {"displayText":"permissions policy","export":true,"for_":["Document"],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"permissions policy","type":"dfn","url":"https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy"},
+"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete": {"displayText":"autocomplete","export":true,"for_":["button","fieldset","input","object","output","select","textarea"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"autocomplete","type":"element-attr","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete"},
+"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens": {"displayText":"autofill detail token","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"autofill detail token","type":"dfn","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens"},
+"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type": {"displayText":"non-autofill credential type","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"non-autofill credential type","type":"dfn","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type"},
+"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element": {"displayText":"textarea","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"textarea","type":"element","url":"https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element"},
+"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use": {"displayText":"allowed to use","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"allowed to use","type":"dfn","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
+"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow": {"displayText":"allow","export":true,"for_":["iframe"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"allow","type":"element-attr","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow"},
+"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element": {"displayText":"iframe","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"iframe","type":"element","url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
+"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel": {"displayText":"in parallel","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"in parallel","type":"dfn","url":"https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel"},
+"https://html.spec.whatwg.org/multipage/input.html#the-input-element": {"displayText":"input","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"input","type":"element","url":"https://html.spec.whatwg.org/multipage/input.html#the-input-element"},
+"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation": {"displayText":"consume user activation","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"consume user activation","type":"dfn","url":"https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation"},
+"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation": {"displayText":"transient activation","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"transient activation","type":"dfn","url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
+"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window": {"displayText":"Window","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"Window","type":"interface","url":"https://html.spec.whatwg.org/multipage/nav-history-apis.html#window"},
+"https://html.spec.whatwg.org/multipage/origin.html#concept-origin": {"displayText":"origin","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
+"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque": {"displayText":"opaque origin","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"opaque origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
+"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain": {"displayText":"document.domain","export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"document.domain","type":"dfn","url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin": {"displayText":"top-level origin","export":true,"for_":["environment"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"top-level origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global": {"displayText":"relevant global object","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"relevant global object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global": {"displayText":"global object","export":true,"for_":["environment settings object"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"global object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin": {"displayText":"origin","export":true,"for_":["environment settings object"],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object": {"displayText":"current settings object","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"current settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object": {"displayText":"environment settings object","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"environment settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object": {"displayText":"relevant settings object","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"relevant settings object","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
+"https://html.spec.whatwg.org/multipage/webappapis.html#secure-context": {"displayText":"secure context","export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"secure context","type":"dfn","url":"https://html.spec.whatwg.org/multipage/webappapis.html#secure-context"},
+"https://infra.spec.whatwg.org/#boolean": {"displayText":"boolean","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"boolean","type":"dfn","url":"https://infra.spec.whatwg.org/#boolean"},
+"https://infra.spec.whatwg.org/#byte-sequence": {"displayText":"byte sequence","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"byte sequence","type":"dfn","url":"https://infra.spec.whatwg.org/#byte-sequence"},
+"https://infra.spec.whatwg.org/#iteration-continue": {"displayText":"continue","export":true,"for_":["iteration"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"continue","type":"dfn","url":"https://infra.spec.whatwg.org/#iteration-continue"},
+"https://infra.spec.whatwg.org/#iteration-while": {"displayText":"while","export":true,"for_":["iteration"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"while","type":"dfn","url":"https://infra.spec.whatwg.org/#iteration-while"},
+"https://infra.spec.whatwg.org/#list": {"displayText":"list","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"list","type":"dfn","url":"https://infra.spec.whatwg.org/#list"},
+"https://infra.spec.whatwg.org/#list-append": {"displayText":"append","export":true,"for_":["list"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"append","type":"dfn","url":"https://infra.spec.whatwg.org/#list-append"},
+"https://infra.spec.whatwg.org/#list-contain": {"displayText":"contain","export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"contain","type":"dfn","url":"https://infra.spec.whatwg.org/#list-contain"},
+"https://infra.spec.whatwg.org/#list-empty": {"displayText":"empty","export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"empty","type":"dfn","url":"https://infra.spec.whatwg.org/#list-empty"},
+"https://infra.spec.whatwg.org/#list-is-empty": {"displayText":"is empty","export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"is empty","type":"dfn","url":"https://infra.spec.whatwg.org/#list-is-empty"},
+"https://infra.spec.whatwg.org/#list-item": {"displayText":"item","export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"item","type":"dfn","url":"https://infra.spec.whatwg.org/#list-item"},
+"https://infra.spec.whatwg.org/#list-iterate": {"displayText":"for each","export":true,"for_":["list","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"for each","type":"dfn","url":"https://infra.spec.whatwg.org/#list-iterate"},
+"https://infra.spec.whatwg.org/#list-remove": {"displayText":"remove","export":true,"for_":["list","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"remove","type":"dfn","url":"https://infra.spec.whatwg.org/#list-remove"},
+"https://infra.spec.whatwg.org/#list-size": {"displayText":"size","export":true,"for_":["list","stack","queue","set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"size","type":"dfn","url":"https://infra.spec.whatwg.org/#list-size"},
+"https://infra.spec.whatwg.org/#map-entry": {"displayText":"entry","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"entry","type":"dfn","url":"https://infra.spec.whatwg.org/#map-entry"},
+"https://infra.spec.whatwg.org/#map-exists": {"displayText":"exist","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"exist","type":"dfn","url":"https://infra.spec.whatwg.org/#map-exists"},
+"https://infra.spec.whatwg.org/#map-getting-the-keys": {"displayText":"keys","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"keys","type":"dfn","url":"https://infra.spec.whatwg.org/#map-getting-the-keys"},
+"https://infra.spec.whatwg.org/#map-iterate": {"displayText":"for each","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"for each","type":"dfn","url":"https://infra.spec.whatwg.org/#map-iterate"},
+"https://infra.spec.whatwg.org/#map-key": {"displayText":"key","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"key","type":"dfn","url":"https://infra.spec.whatwg.org/#map-key"},
+"https://infra.spec.whatwg.org/#map-remove": {"displayText":"remove","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"remove","type":"dfn","url":"https://infra.spec.whatwg.org/#map-remove"},
+"https://infra.spec.whatwg.org/#map-set": {"displayText":"set","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"set","type":"dfn","url":"https://infra.spec.whatwg.org/#map-set"},
+"https://infra.spec.whatwg.org/#map-value": {"displayText":"value","export":true,"for_":["map"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"value","type":"dfn","url":"https://infra.spec.whatwg.org/#map-value"},
+"https://infra.spec.whatwg.org/#ordered-map": {"displayText":"map","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"map","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-map"},
+"https://infra.spec.whatwg.org/#ordered-set": {"displayText":"ordered set","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"ordered set","type":"dfn","url":"https://infra.spec.whatwg.org/#ordered-set"},
+"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes": {"displayText":"serialize JSON to bytes","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"serialize json to bytes","type":"dfn","url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes"},
+"https://infra.spec.whatwg.org/#set-append": {"displayText":"append","export":true,"for_":["set"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"append","type":"dfn","url":"https://infra.spec.whatwg.org/#set-append"},
+"https://infra.spec.whatwg.org/#struct": {"displayText":"struct","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"struct","type":"dfn","url":"https://infra.spec.whatwg.org/#struct"},
+"https://infra.spec.whatwg.org/#struct-item": {"displayText":"item","export":true,"for_":["struct","tuple"],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"item","type":"dfn","url":"https://infra.spec.whatwg.org/#struct-item"},
+"https://infra.spec.whatwg.org/#willful-violation": {"displayText":"willful violation","export":true,"for_":[],"level":"1","normative":true,"shortname":"infra","spec":"infra","status":"current","text":"willful violation","type":"dfn","url":"https://infra.spec.whatwg.org/#willful-violation"},
+"https://pages.nist.gov/800-63-3/sp800-63-3.html#af": {"displayText":"authentication factor","export":true,"for_":[],"level":"","normative":true,"shortname":"sp800-800-63r3","spec":"sp800-800-63r3","status":"anchor-block","text":"authentication factor","type":"dfn","url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
+"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf": {"displayText":"single-factor","export":true,"for_":[],"level":"","normative":true,"shortname":"sp800-800-63r3","spec":"sp800-800-63r3","status":"anchor-block","text":"single-factor","type":"dfn","url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf"},
+"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor": {"displayText":"%ArrayBuffer%","export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"%arraybuffer%","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-arraybuffer-constructor"},
+"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots": {"displayText":"internal method","export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"internal method","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
+"https://tc39.github.io/ecma262/#sec-own-property": {"displayText":"own property","export":true,"for_":[],"level":"","normative":true,"shortname":"ecmascript","spec":"ecmascript","status":"anchor-block","text":"own property","type":"dfn","url":"https://tc39.github.io/ecma262/#sec-own-property"},
+"https://tools.ietf.org/html/bcp47#section-2.1": {"displayText":"language tag","export":true,"for_":[],"level":"","normative":true,"shortname":"bcp47","spec":"bcp47","status":"anchor-block","text":"language tag","type":"dfn","url":"https://tools.ietf.org/html/bcp47#section-2.1"},
+"https://tools.ietf.org/html/rfc4949#page-186": {"displayText":"man-in-the-middle attack","export":true,"for_":[],"level":"","normative":true,"shortname":"rfc4949","spec":"rfc4949","status":"anchor-block","text":"man-in-the-middle attack","type":"dfn","url":"https://tools.ietf.org/html/rfc4949#page-186"},
+"https://tools.ietf.org/html/rfc4949#page-258": {"displayText":"salted","export":true,"for_":[],"level":"","normative":true,"shortname":"rfc4949","spec":"rfc4949","status":"anchor-block","text":"salted","type":"dfn","url":"https://tools.ietf.org/html/rfc4949#page-258"},
+"https://tools.ietf.org/html/rfc5280#section-4.1.2.7": {"displayText":"SubjectPublicKeyInfo","export":true,"for_":[],"level":"","normative":true,"shortname":"rfc5280","spec":"rfc5280","status":"anchor-block","text":"subjectpublickeyinfo","type":"dfn","url":"https://tools.ietf.org/html/rfc5280#section-4.1.2.7"},
+"https://tools.ietf.org/html/rfc8230#section-2": {"displayText":"Section 2","export":true,"for_":["RFC8230"],"level":"","normative":true,"shortname":"rfc8230","spec":"rfc8230","status":"anchor-block","text":"section 2","type":"dfn","url":"https://tools.ietf.org/html/rfc8230#section-2"},
+"https://tools.ietf.org/html/rfc8230#section-4": {"displayText":"Section 4","export":true,"for_":["RFC8230"],"level":"","normative":true,"shortname":"rfc8230","spec":"rfc8230","status":"anchor-block","text":"section 4","type":"dfn","url":"https://tools.ietf.org/html/rfc8230#section-4"},
+"https://tools.ietf.org/html/rfc8471#section-1": {"displayText":"Token Binding","export":true,"for_":[],"level":"","normative":true,"shortname":"tokenbinding","spec":"tokenbinding","status":"anchor-block","text":"token binding","type":"dfn","url":"https://tools.ietf.org/html/rfc8471#section-1"},
+"https://tools.ietf.org/html/rfc8471#section-3.2": {"displayText":"Token Binding ID","export":true,"for_":[],"level":"","normative":true,"shortname":"tokenbinding","spec":"tokenbinding","status":"anchor-block","text":"token binding id","type":"dfn","url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
+"https://tools.ietf.org/html/rfc8610#section-3.9": {"displayText":"group sockets","export":true,"for_":[],"level":"","normative":true,"shortname":"rfc8610","spec":"rfc8610","status":"anchor-block","text":"group sockets","type":"dfn","url":"https://tools.ietf.org/html/rfc8610#section-3.9"},
+"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters": {"displayText":"kty","export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"kty","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
+"https://tools.ietf.org/html/rfc9052#name-key-objects": {"displayText":"COSE key","export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"cose key","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#name-key-objects"},
+"https://tools.ietf.org/html/rfc9052#section-7": {"displayText":"section 7","export":true,"for_":["RFC9052"],"level":"","normative":true,"shortname":"rfc9052","spec":"rfc9052","status":"anchor-block","text":"section 7","type":"dfn","url":"https://tools.ietf.org/html/rfc9052#section-7"},
+"https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves": {"displayText":"crv","export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"crv","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves"},
+"https://tools.ietf.org/html/rfc9053#section-2": {"displayText":"section 2","export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 2","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-2"},
+"https://tools.ietf.org/html/rfc9053#section-2.1": {"displayText":"section 2.1","export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 2.1","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-2.1"},
+"https://tools.ietf.org/html/rfc9053#section-7.1": {"displayText":"section 7.1","export":true,"for_":["RFC9053"],"level":"","normative":true,"shortname":"rfc9053","spec":"rfc9053","status":"anchor-block","text":"section 7.1","type":"dfn","url":"https://tools.ietf.org/html/rfc9053#section-7.1"},
+"https://url.spec.whatwg.org#concept-url-port": {"displayText":"port","export":true,"for_":[],"level":"","normative":true,"shortname":"url","spec":"url","status":"anchor-block","text":"port","type":"dfn","url":"https://url.spec.whatwg.org#concept-url-port"},
+"https://url.spec.whatwg.org#concept-url-scheme": {"displayText":"scheme","export":true,"for_":[],"level":"","normative":true,"shortname":"url","spec":"url","status":"anchor-block","text":"scheme","type":"dfn","url":"https://url.spec.whatwg.org#concept-url-scheme"},
+"https://url.spec.whatwg.org/#concept-domain": {"displayText":"domain","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"domain","type":"dfn","url":"https://url.spec.whatwg.org/#concept-domain"},
+"https://url.spec.whatwg.org/#concept-ipv4": {"displayText":"IPv4 address","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"ipv4 address","type":"dfn","url":"https://url.spec.whatwg.org/#concept-ipv4"},
+"https://url.spec.whatwg.org/#concept-ipv6": {"displayText":"IPv6 address","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"ipv6 address","type":"dfn","url":"https://url.spec.whatwg.org/#concept-ipv6"},
+"https://url.spec.whatwg.org/#concept-url-host": {"displayText":"host","export":true,"for_":["url"],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"host","type":"dfn","url":"https://url.spec.whatwg.org/#concept-url-host"},
+"https://url.spec.whatwg.org/#concept-url-parser": {"displayText":"URL parser","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"url parser","type":"dfn","url":"https://url.spec.whatwg.org/#concept-url-parser"},
+"https://url.spec.whatwg.org/#domain-label": {"displayText":"domain label","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"domain label","type":"dfn","url":"https://url.spec.whatwg.org/#domain-label"},
+"https://url.spec.whatwg.org/#empty-host": {"displayText":"empty host","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"empty host","type":"dfn","url":"https://url.spec.whatwg.org/#empty-host"},
+"https://url.spec.whatwg.org/#host-public-suffix": {"displayText":"public suffix","export":true,"for_":["host"],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"public suffix","type":"dfn","url":"https://url.spec.whatwg.org/#host-public-suffix"},
+"https://url.spec.whatwg.org/#host-registrable-domain": {"displayText":"registrable domain","export":true,"for_":["host"],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"registrable domain","type":"dfn","url":"https://url.spec.whatwg.org/#host-registrable-domain"},
+"https://url.spec.whatwg.org/#opaque-host": {"displayText":"opaque host","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"opaque host","type":"dfn","url":"https://url.spec.whatwg.org/#opaque-host"},
+"https://url.spec.whatwg.org/#valid-domain": {"displayText":"valid domain","export":false,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"valid domain","type":"dfn","url":"https://url.spec.whatwg.org/#valid-domain"},
+"https://url.spec.whatwg.org/#valid-domain-string": {"displayText":"valid domain string","export":true,"for_":[],"level":"1","normative":true,"shortname":"url","spec":"url","status":"current","text":"valid domain string","type":"dfn","url":"https://url.spec.whatwg.org/#valid-domain-string"},
+"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster": {"displayText":"grapheme cluster","export":true,"for_":[],"level":"1","normative":false,"shortname":"i18n-glossary","spec":"i18n-glossary","status":"current","text":"grapheme cluster","type":"dfn","url":"https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster"},
+"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential": {"displayText":"Create a Credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Create a Credential","type":"abstract-op","url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential"},
+"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential": {"displayText":"Request a Credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Request a Credential","type":"abstract-op","url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
+"https://w3c.github.io/webappsec-credential-management/#concept-credential": {"displayText":"credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"credential","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
+"https://w3c.github.io/webappsec-credential-management/#credential": {"displayText":"Credential","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"Credential","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credential"},
+"https://w3c.github.io/webappsec-credential-management/#credential-source": {"displayText":"credential source","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"credential source","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#credential-source"},
+"https://w3c.github.io/webappsec-credential-management/#credentialscontainer": {"displayText":"CredentialsContainer","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"CredentialsContainer","type":"interface","url":"https://w3c.github.io/webappsec-credential-management/#credentialscontainer"},
+"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions": {"displayText":"CredentialCreationOptions","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"CredentialCreationOptions","type":"dictionary","url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions"},
+"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions": {"displayText":"CredentialRequestOptions","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"CredentialRequestOptions","type":"dictionary","url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot": {"displayText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot": {"displayText":"[[Create]](origin, options, sameOriginWithAncestors)","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[Create]](origin, options, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote": {"displayText":"remote","export":true,"for_":["Credential/[[discovery]]"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"remote","type":"enum-value","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot": {"displayText":"[[discovery]]","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[discovery]]","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-id": {"displayText":"id","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"id","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-id"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot": {"displayText":"[[Store]](credential, sameOriginWithAncestors)","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[Store]](credential, sameOriginWithAncestors)","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-type": {"displayText":"type","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"type","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot": {"displayText":"[[type]]","export":true,"for_":["Credential"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"[[type]]","type":"attribute","url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation": {"displayText":"mediation","export":true,"for_":["CredentialCreationOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"mediation","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal": {"displayText":"signal","export":true,"for_":["CredentialCreationOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"signal","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-signal"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional": {"displayText":"conditional","export":true,"for_":["CredentialMediationRequirement"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"conditional","type":"enum-value","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation": {"displayText":"mediation","export":true,"for_":["CredentialRequestOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"mediation","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal": {"displayText":"signal","export":true,"for_":["CredentialRequestOptions"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"signal","type":"dict-member","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create": {"displayText":"create()","export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"create()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get": {"displayText":"get()","export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"get()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess": {"displayText":"preventSilentAccess()","export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"preventSilentAccess()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess"},
+"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store": {"displayText":"store()","export":true,"for_":["CredentialsContainer"],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"store()","type":"method","url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store"},
+"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors": {"displayText":"same-origin with its ancestors","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"anchor-block","text":"same-origin with its ancestors","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
+"https://w3c.github.io/webappsec-credential-management/#user-mediated": {"displayText":"user mediation","export":true,"for_":[],"level":"1","normative":true,"shortname":"credential-management","spec":"credential-management-1","status":"current","text":"user mediation","type":"dfn","url":"https://w3c.github.io/webappsec-credential-management/#user-mediated"},
+"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature": {"displayText":"policy-controlled feature","export":true,"for_":[],"level":"1","normative":true,"shortname":"permissions-policy","spec":"permissions-policy-1","status":"current","text":"policy-controlled feature","type":"dfn","url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature"},
+"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist": {"displayText":"default allowlists","export":true,"for_":["policy-controlled feature"],"level":"1","normative":true,"shortname":"permissions-policy","spec":"permissions-policy-1","status":"current","text":"default allowlists","type":"dfn","url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist"},
+"https://w3c.github.io/webdriver/#dfn-endpoint-node": {"displayText":"endpoint node","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"endpoint node","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-endpoint-node"},
+"https://w3c.github.io/webdriver/#dfn-error": {"displayText":"WebDriver error","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"webdriver error","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-error"},
+"https://w3c.github.io/webdriver/#dfn-error-code": {"displayText":"WebDriver error code","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"webdriver error code","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-error-code"},
+"https://w3c.github.io/webdriver/#dfn-extension-capability": {"displayText":"extension capability","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"extension capability","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-extension-capability"},
+"https://w3c.github.io/webdriver/#dfn-extension-commands": {"displayText":"extension command","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"extension command","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-extension-commands"},
+"https://w3c.github.io/webdriver/#dfn-getting-properties": {"displayText":"getting a property","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"getting a property","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-getting-properties"},
+"https://w3c.github.io/webdriver/#dfn-invalid-argument": {"displayText":"invalid argument","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"invalid argument","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-invalid-argument"},
+"https://w3c.github.io/webdriver/#dfn-matching-capabilities": {"displayText":"matching capabilities","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"matching capabilities","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-matching-capabilities"},
+"https://w3c.github.io/webdriver/#dfn-object": {"displayText":"Object","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"object","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-object"},
+"https://w3c.github.io/webdriver/#dfn-remote-end-steps": {"displayText":"remote end steps","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"remote end steps","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-remote-end-steps"},
+"https://w3c.github.io/webdriver/#dfn-set-a-property": {"displayText":"set a property","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"set a property","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-set-a-property"},
+"https://w3c.github.io/webdriver/#dfn-success": {"displayText":"success","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"success","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-success"},
+"https://w3c.github.io/webdriver/#dfn-unsupported-operation": {"displayText":"unsupported operation","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"unsupported operation","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-unsupported-operation"},
+"https://w3c.github.io/webdriver/#dfn-validate-capabilities": {"displayText":"validating capabilities","export":true,"for_":[],"level":"","normative":true,"shortname":"webdriver","spec":"webdriver","status":"anchor-block","text":"validating capabilities","type":"dfn","url":"https://w3c.github.io/webdriver/#dfn-validate-capabilities"},
+"https://webidl.spec.whatwg.org/#BufferSource": {"displayText":"BufferSource","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"BufferSource","type":"typedef","url":"https://webidl.spec.whatwg.org/#BufferSource"},
+"https://webidl.spec.whatwg.org/#Exposed": {"displayText":"Exposed","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"Exposed","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#Exposed"},
+"https://webidl.spec.whatwg.org/#SameObject": {"displayText":"SameObject","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SameObject","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SameObject"},
+"https://webidl.spec.whatwg.org/#SecureContext": {"displayText":"SecureContext","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SecureContext","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SecureContext"},
+"https://webidl.spec.whatwg.org/#a-new-promise": {"displayText":"a new promise","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"a new promise","type":"dfn","url":"https://webidl.spec.whatwg.org/#a-new-promise"},
+"https://webidl.spec.whatwg.org/#a-promise-rejected-with": {"displayText":"a promise rejected with","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"a promise rejected with","type":"dfn","url":"https://webidl.spec.whatwg.org/#a-promise-rejected-with"},
+"https://webidl.spec.whatwg.org/#a-promise-resolved-with": {"displayText":"a promise resolved with","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"a promise resolved with","type":"dfn","url":"https://webidl.spec.whatwg.org/#a-promise-resolved-with"},
+"https://webidl.spec.whatwg.org/#aborterror": {"displayText":"AbortError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"AbortError","type":"exception","url":"https://webidl.spec.whatwg.org/#aborterror"},
+"https://webidl.spec.whatwg.org/#constrainterror": {"displayText":"ConstraintError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ConstraintError","type":"exception","url":"https://webidl.spec.whatwg.org/#constrainterror"},
+"https://webidl.spec.whatwg.org/#dfn-buffer-source-type": {"displayText":"buffer source types","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"buffer source types","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
+"https://webidl.spec.whatwg.org/#dfn-enumeration-value": {"displayText":"enumeration value","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"enumeration value","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-enumeration-value"},
+"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy": {"displayText":"get a copy of the bytes held by the buffer source","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"get a copy of the bytes held by the buffer source","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy"},
+"https://webidl.spec.whatwg.org/#dfn-interface-object": {"displayText":"interface object","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"interface object","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-interface-object"},
+"https://webidl.spec.whatwg.org/#dfn-json-types": {"displayText":"JSON type","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"json type","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
+"https://webidl.spec.whatwg.org/#dfn-simple-exception": {"displayText":"simple exception","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"simple exception","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-simple-exception"},
+"https://webidl.spec.whatwg.org/#encodingerror": {"displayText":"EncodingError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"EncodingError","type":"exception","url":"https://webidl.spec.whatwg.org/#encodingerror"},
+"https://webidl.spec.whatwg.org/#exceptiondef-typeerror": {"displayText":"TypeError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"TypeError","type":"exception","url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
+"https://webidl.spec.whatwg.org/#idl-ArrayBuffer": {"displayText":"ArrayBuffer","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ArrayBuffer","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},
+"https://webidl.spec.whatwg.org/#idl-DOMException": {"displayText":"DOMException","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"DOMException","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
+"https://webidl.spec.whatwg.org/#idl-DOMString": {"displayText":"DOMString","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"DOMString","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
+"https://webidl.spec.whatwg.org/#idl-boolean": {"displayText":"boolean","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"boolean","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-boolean"},
+"https://webidl.spec.whatwg.org/#idl-long": {"displayText":"long","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"long","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-long"},
+"https://webidl.spec.whatwg.org/#idl-object": {"displayText":"object","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"object","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-object"},
+"https://webidl.spec.whatwg.org/#idl-promise": {"displayText":"Promise","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"Promise","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-promise"},
+"https://webidl.spec.whatwg.org/#idl-record": {"displayText":"record","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"record","type":"dfn","url":"https://webidl.spec.whatwg.org/#idl-record"},
+"https://webidl.spec.whatwg.org/#idl-sequence": {"displayText":"sequence","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"sequence","type":"dfn","url":"https://webidl.spec.whatwg.org/#idl-sequence"},
+"https://webidl.spec.whatwg.org/#idl-undefined": {"displayText":"undefined","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"undefined","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-undefined"},
+"https://webidl.spec.whatwg.org/#idl-unsigned-long": {"displayText":"unsigned long","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"unsigned long","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-unsigned-long"},
+"https://webidl.spec.whatwg.org/#invalidstateerror": {"displayText":"InvalidStateError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"InvalidStateError","type":"exception","url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
+"https://webidl.spec.whatwg.org/#notallowederror": {"displayText":"NotAllowedError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"NotAllowedError","type":"exception","url":"https://webidl.spec.whatwg.org/#notallowederror"},
+"https://webidl.spec.whatwg.org/#notsupportederror": {"displayText":"NotSupportedError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"NotSupportedError","type":"exception","url":"https://webidl.spec.whatwg.org/#notsupportederror"},
+"https://webidl.spec.whatwg.org/#reject": {"displayText":"reject","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"reject","type":"dfn","url":"https://webidl.spec.whatwg.org/#reject"},
+"https://webidl.spec.whatwg.org/#resolve": {"displayText":"resolve","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"resolve","type":"dfn","url":"https://webidl.spec.whatwg.org/#resolve"},
+"https://webidl.spec.whatwg.org/#securityerror": {"displayText":"SecurityError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SecurityError","type":"exception","url":"https://webidl.spec.whatwg.org/#securityerror"},
+"https://webidl.spec.whatwg.org/#syntaxerror": {"displayText":"SyntaxError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SyntaxError","type":"exception","url":"https://webidl.spec.whatwg.org/#syntaxerror"},
+"https://webidl.spec.whatwg.org/#unknownerror": {"displayText":"UnknownError","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"UnknownError","type":"exception","url":"https://webidl.spec.whatwg.org/#unknownerror"},
+"https://webidl.spec.whatwg.org/#upon-fulfillment": {"displayText":"upon fulfillment","export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"upon fulfillment","type":"dfn","url":"https://webidl.spec.whatwg.org/#upon-fulfillment"},
+"https://www.w3.org/TR/page-visibility/#visibility-states": {"displayText":"visibility states","export":true,"for_":[],"level":"","normative":true,"shortname":"page-visibility","spec":"page-visibility","status":"anchor-block","text":"visibility states","type":"dfn","url":"https://www.w3.org/TR/page-visibility/#visibility-states"},
+"https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-collectfromcredentialstore-slot": {"displayText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","export":true,"for_":["PublicKeyCredential"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"snapshot","text":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","type":"method","url":"https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-collectfromcredentialstore-slot"},
 };
 
 function mkRefHint(link, ref) {
     const linkText = link.textContent;
     let dfnTextElements = '';
-    if (ref.text != linkText) {
+    if (ref.displayText.toLowerCase() != linkText.toLowerCase()) {
+        // Give the original term if it's being displayed in a different way.
+        // But allow casing differences, they're insignificant.
         dfnTextElements =
             mk.li({},
                 mk.b({}, "Term: "),
-                mk.span({}, ref.text)
+                mk.span({}, ref.displayText)
             );
     }
     const forList = ref.for_;