From de1fccab171a2a91dfecefc908572052daed80c4 Mon Sep 17 00:00:00 2001
From: Nick Steele <344821+nicksteele@users.noreply.github.com>
Date: Wed, 9 Oct 2024 18:15:24 +0000
Subject: [PATCH] Merge pull request #2174 from w3c/issue-2088-prf-test-vectors

SHA: d9204428c6d92ec1a0712110939cdf8156bc1818
Reason: push, by nicksteele

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 316 +++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 259 insertions(+), 57 deletions(-)

diff --git a/index.html b/index.html
index 5c65bc5af..e69c514bb 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 6270e4735, updated Tue Aug 6 12:12:30 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="cfa73332d4aeed226074903ae09508cb2b39177a" name="revision">
+  <meta content="d9204428c6d92ec1a0712110939cdf8156bc1818" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -1288,7 +1288,12 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-appid-extension"><span class="secno">10.1.1</span> <span class="content">FIDO <span>AppID</span> Extension (appid)</span></a>
         <li><a href="#sctn-appid-exclude-extension"><span class="secno">10.1.2</span> <span class="content">FIDO AppID Exclusion Extension (appidExclude)</span></a>
         <li><a href="#sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3</span> <span class="content">Credential Properties Extension (<span>credProps</span>)</span></a>
-        <li><a href="#prf-extension"><span class="secno">10.1.4</span> <span class="content">Pseudo-random function extension (<span>prf</span>)</span></a>
+        <li>
+         <a href="#prf-extension"><span class="secno">10.1.4</span> <span class="content">Pseudo-random function extension (<span>prf</span>)</span></a>
+         <ol class="toc">
+          <li><a href="#prf-extension-test-vectors-webauthn"><span class="secno">10.1.4.1</span> <span class="content">Test vectors: Web Authentication API</span></a>
+          <li><a href="#prf-extension-test-vectors-ctap"><span class="secno">10.1.4.2</span> <span class="content">Test vectors: CTAP2 <code>hmac-secret</code> extension</span></a>
+         </ol>
         <li><a href="#sctn-large-blob-extension"><span class="secno">10.1.5</span> <span class="content">Large blob storage extension (<span>largeBlob</span>)</span></a>
        </ol>
       <li><a href="#sctn-defined-authenticator-extensions"><span class="secno">10.2</span> <span class="content">Authenticator Extensions</span></a>
@@ -7720,6 +7725,203 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       </dl>
      </div>
    </dl>
+   <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors-webauthn"><span class="secno">10.1.4.1. </span><span class="content">Test vectors: Web Authentication API</span><a class="self-link" href="#prf-extension-test-vectors-webauthn"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②①">WebAuthn Client</a> implementations of and <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Party</a> usage of the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
+The examples are not exhaustive.</p>
+   <ul>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled③">enabled</a></code> output is always present during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>,
+and never present during <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremonies</a>:</p>
+<pre class="example highlight" id="example-5584eab4"><a class="self-link" href="#example-5584eab4"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.create():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>false</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results③">results</a></code> output may be present
+during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑨">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑥">evalByCredential</a></code> input is present:</p>
+<pre class="example highlight" id="example-70210d97"><a class="self-link" href="#example-70210d97"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> eval<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>])</c-> <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.create():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>false</c-> <c- p>}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> enabled<c- o>:</c-> <c- kc>true</c-><c- p>,</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results④">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second④">second</a></code></code> output
+is present if and only if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑤">results</a></code> output is present
+and the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑤">second</a></code></code> input was present in the chosen PRF inputs:</p>
+<pre class="example highlight" id="example-abd7c645"><a class="self-link" href="#example-abd7c645"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    eval<c- o>:</c-> <c- p>{</c->
+      first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>]),</c->
+      second<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>5</c-><c- p>,</c-> <c- mf>6</c-><c- p>,</c-> <c- mf>7</c-><c- p>,</c-> <c- mf>8</c-><c- p>]),</c->
+    <c- p>},</c->
+    evalByCredential<c- o>:</c-> <c- p>{</c->
+      <c- u>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE"</c-><c- o>:</c-> <c- p>{</c->
+        first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>]),</c->
+      <c- p>}</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get() if credential "e02eZ9lP..." was used:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get() if a different credential was used:</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
+<c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer<c- p>,</c-> second<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
+</pre>
+    <li data-md>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first②">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑥">second</a></code> outputs
+may be any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①④">BufferSource</a></code> type.
+Equal <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first③">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑦">second</a></code> inputs
+result in equal <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first④">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑧">second</a></code> outputs:</p>
+<pre class="example highlight" id="example-b1f3f15a"><a class="self-link" href="#example-b1f3f15a"></a><c- c1>// Example extension inputs:</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    evalByCredential<c- o>:</c-> <c- p>{</c->
+      <c- u>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE"</c-><c- o>:</c-> <c- p>{</c->
+        first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>]),</c->
+        second<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>9</c-><c- p>,</c-> <c- mf>10</c-><c- p>,</c-> <c- mf>11</c-><c- p>,</c-> <c- mf>12</c-><c- p>])</c->
+      <c- p>}</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+
+<c- c1>// Example client extension outputs from navigator.credentials.get():</c->
+<c- p>{</c->
+  prf<c- o>:</c-> <c- p>{</c->
+    results<c- o>:</c-> <c- p>{</c->
+      first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mh>0xc4</c-><c- p>,</c-> <c- mh>0x17</c-><c- p>,</c-> <c- mh>0x2e</c-><c- p>,</c-> <c- mh>0x98</c-><c- p>,</c-> <c- mh>0x2e</c-><c- p>,</c-> <c- mh>0x90</c-><c- p>,</c-> <c- mh>0x97</c-><c- p>,</c-> <c- mh>0xc3</c-><c- p>,</c-> <c- mh>0x9a</c-><c- p>,</c-> <c- mh>0x6c</c-><c- p>,</c-> <c- mh>0x0c</c-><c- p>,</c-> <c- mh>0xb7</c-><c- p>,</c-> <c- mh>0x20</c-><c- p>,</c-> <c- mh>0xcb</c-><c- p>,</c-> <c- mh>0x37</c-><c- p>,</c-> <c- mh>0x5b</c-><c- p>,</c-> <c- mh>0x92</c-><c- p>,</c-> <c- mh>0xe3</c-><c- p>,</c-> <c- mh>0xfc</c-><c- p>,</c-> <c- mh>0xad</c-><c- p>,</c-> <c- mh>0x15</c-><c- p>,</c-> <c- mh>0x4a</c-><c- p>,</c-> <c- mh>0x63</c-><c- p>,</c-> <c- mh>0xe4</c-><c- p>,</c-> <c- mh>0x3a</c-><c- p>,</c-> <c- mh>0x93</c-><c- p>,</c-> <c- mh>0xf1</c-><c- p>,</c-> <c- mh>0x09</c-><c- p>,</c-> <c- mh>0x6b</c-><c- p>,</c-> <c- mh>0x1e</c-><c- p>,</c-> <c- mh>0x19</c-><c- p>,</c-> <c- mh>0x73</c-><c- p>]),</c->
+      second<c- o>:</c-> <c- ow>new</c-> Uint32Array<c- p>([</c-><c- mh>0x982e17c4</c-><c- p>,</c-> <c- mh>0xc397902e</c-><c- p>,</c-> <c- mh>0xb70c6c9a</c-><c- p>,</c-> <c- mh>0x5b37cb20</c-><c- p>,</c-> <c- mh>0xadfce392</c-><c- p>,</c-> <c- mh>0xe4634a15</c-><c- p>,</c-> <c- mh>0x09f1933a</c-><c- p>,</c-> <c- mh>0x73191e6b</c-><c- p>]),</c->
+    <c- p>}</c->
+  <c- p>}</c->
+<c- p>}</c->
+</pre>
+   </ul>
+   <p>Pseudo-random values used in this section were generated as follows:</p>
+   <ul>
+    <li data-md>
+     <p><code>"e02eZ9lPp0UdkF4vGRO4-NxlhWBkL1FCmsmb1tTfRyE" = Base64Url(SHA-256(UTF-8("WebAuthn PRF test vectors") || 0x00))</code></p>
+    <li data-md>
+     <p><code>h'c4172e982e9097c39a6c0cb720cb375b92e3fcad154a63e43a93f1096b1e1973' = SHA-256(UTF-8("WebAuthn PRF test vectors") || 0x01)</code></p>
+   </ul>
+   <h5 class="heading settled" data-level="10.1.4.2" id="prf-extension-test-vectors-ctap"><span class="secno">10.1.4.2. </span><span class="content">Test vectors: CTAP2 <code>hmac-secret</code> extension</span><a class="self-link" href="#prf-extension-test-vectors-ctap"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②②">WebAuthn Client</a> implementations
+of how the <a data-link-type="dfn" href="#prf" id="ref-for-prf②">prf</a> extension uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension.
+The examples are given in CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> notation.
+The examples are not exhaustive.</p>
+   <ul>
+    <li data-md>
+     <p>The following shared definitions are used in all subsequent examples:</p>
+<pre class="example highlight" id="example-ec79b3a4"><a class="self-link" href="#example-ec79b3a4"></a><c- c1>; Given input parameters:</c->
+<c- nc>platform_key_agreement_private_key</c-> <c- o>=</c-> <c- mh>0x0971bc7fb1be48270adcd3d9a5fc15d5fb0f335b3071ff36a54c007fa6c76514</c->
+<c- nc>authenticator_key_agreement_public_key</c-> <c- o>=</c-> <c- p>{</c->
+    <c- mi>1</c-><c- p>:</c-> <c- mi>2</c-><c- p>,</c->
+    <c- mi>3</c-><c- p>:</c-> <c- mi>-25</c-><c- p>,</c->
+    <c- mi>-1</c-><c- p>:</c-> <c- mi>1</c-><c- p>,</c->
+    <c- mi>-2</c-><c- p>:</c-> h<c- t>'a30522c2de402b561965c3cf949a1cab020c6f6ea36fcf7e911ac1a0f1515300'</c-><c- p>,</c->
+    <c- mi>-3</c-><c- p>:</c-> h<c- t>'9961a929abdb2f42e6566771887d41484d889e735e3248518a53112d2b915f00'</c-><c- p>,</c->
+<c- p>}</c->
+<c- nc>authenticator_cred_random</c-> <c- o>=</c-> h<c- t>'437e065e723a98b2f08f39d8baf7c53ecb3c363c5e5104bdaaf5d5ca2e028154'</c->
+</pre>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑤">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑨">second</a></code> inputs
+are mapped in the examples as <code>prf_eval_first</code> and <code>prf_eval_second</code>, respectively.
+The <code>prf_results_first</code> and <code>prf_results_second</code> values in the examples
+are mapped to the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑥">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑥">first</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑦">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second①⓪">second</a></code></code> outputs, respectively.</p>
+    <li data-md>
+     <p>Single input case using PIN protocol 2:</p>
+<pre class="example highlight" id="example-7688ee66"><a class="self-link" href="#example-7688ee66"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'0c63083de8170101d38bcf8bd72309568ddb4550867e23404b35d85712f7c20d8bc911ee23c06034cbc14290b9669bec07739053c5a416e313ef905c79955876'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'437e065e723a98b2f08f39d8baf7c53ebbb2ed3e746b87576fd81f95def5757cad24be18eaef892e97692e684e07da53'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'3bfaa48f7952330d63e35ff8cd5bca48d2a12823828915749287256ab146272f9fb437bf65691243c3f504bd7ea6d5e6'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+</pre>
+    <li data-md>
+     <p>Two input case using PIN protocol 2:</p>
+<pre class="example highlight" id="example-1a1f45ad"><a class="self-link" href="#example-1a1f45ad"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+<c- nc>prf_eval_second</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727303'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'0c63083de8170101d38bcf8bd72309568ddb4550867e23404b35d85712f7c20d8bc911ee23c06034cbc14290b9669bec07739053c5a416e313ef905c79955876'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt2</c-> <c- o>=</c-> h<c- t>'d68ac03329a10ee5e0ec834492bb9a96a0e547baf563bf78ccbe8789b22e776b'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'23dde5e3462daf36559b85c4ac5f9656aa9bfd81c1dc2bf8533c8b9f3882854786b4f500e25b4e3d81f7fc7c742362294d92926c883b3fae1a3673246464bf730446e1fa4698c432a9092477c5dde5e3'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output2</c-> <c- o>=</c-> h<c- t>'a62a8773b19cda90d7ed4ef72a80a804320dbd3997e2f663805ad1fd3293d50b'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'90ee52f739043bc17b3488a74306d7801debb5b61f18662c648a25b5b5678ede482cdaff99a537a44f064fcb10ce6e04dfd27619dc96a0daff8507e499296b1eecf0981f7c8518b277a7a3018f5ec6fb'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>prf_results_second</c-> <c- o>=</c-> h<c- t>'a62a8773b19cda90d7ed4ef72a80a804320dbd3997e2f663805ad1fd3293d50b'</c->
+</pre>
+    <li data-md>
+     <p>Single input case using PIN protocol 1:</p>
+<pre class="example highlight" id="example-1498bea6"><a class="self-link" href="#example-1498bea6"></a><c- c1>; Inputs from Relying Party:</c->
+<c- nc>prf_eval_first</c-> <c- o>=</c-> h<c- t>'576562417574686e20505246207465737420766563746f727302'</c->
+
+<c- c1>; Client computes:</c->
+<c- nc>shared_secret</c-> <c- o>=</c-> h<c- t>'23e5ed7157c25892b77732fb9c8a107e3518800db2af4142f9f4adfacb771d39'</c->
+<c- nc>salt1</c-> <c- o>=</c-> h<c- t>'527413ebb48293772df30f031c5ac4650c7de14bf9498671ae163447b6a772b3'</c->
+<c- nc>salt_enc</c-> <c- o>=</c-> h<c- t>'ab8c878bb05d04700f077ed91845ec9c503c925cb12b327ddbeb4243c397f913'</c->
+
+<c- c1>; Authenticator computes:</c->
+<c- nc>output1</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+<c- nc>output_enc</c-> <c- o>=</c-> h<c- t>'15d4e4f3f04109b492b575c1b38c28585b6719cf8d61304215108d939f37ccfb'</c->
+
+<c- c1>; Client decrypts:</c->
+<c- nc>prf_results_first</c-> <c- o>=</c-> h<c- t>'3c33e07d202c3b029cc21f1722767021bf27d595933b3d2b6a1b9d5dddc77fae'</c->
+</pre>
+   </ul>
+   <p>Inputs and pseudo-random values used in this section were generated as follows:</p>
+   <ul>
+    <li data-md>
+     <p><code>seed = UTF-8("WebAuthn PRF test vectors")</code></p>
+    <li data-md>
+     <p><code>prf_eval_first = seed || 0x02</code></p>
+    <li data-md>
+     <p><code>prf_eval_second = seed || 0x03</code></p>
+    <li data-md>
+     <p><code>platform_key_agreement_private_key = SHA-256(seed || 0x04)</code></p>
+    <li data-md>
+     <p><code>authenticator_key_agreement_public_key = P256-Public-Key(sk)</code> where <code>sk = SHA-256(seed || 0x05)</code></p>
+    <li data-md>
+     <p><code>authenticator_cred_random = SHA-256(seed || 0x06)</code></p>
+    <li data-md>
+     <p><code>iv</code> in single-input <code>salt_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x07)</code></p>
+    <li data-md>
+     <p><code>iv</code> in two-input <code>salt_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x08)</code></p>
+    <li data-md>
+     <p><code>iv</code> in single-input <code>output_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x09)</code></p>
+    <li data-md>
+     <p><code>iv</code> in two-input <code>output_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x0a)</code></p>
+   </ul>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
    <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
@@ -7750,7 +7952,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑨"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
-    <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①④"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
+    <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
      <div>
@@ -7761,7 +7963,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
         <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑥">BufferSource</a></span>
        <dd data-md>
         <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
       </dl>
@@ -7918,7 +8120,7 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
        <td>Pseudo-Random Function Extension Support
        <td><code>"webauthn:extension:prf"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node②">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node②">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#prf" id="ref-for-prf③">prf</a> extension.
       <tr>
        <td>Large Blob Storage Extension Support
        <td><code>"webauthn:extension:largeBlob"</code>
@@ -8545,7 +8747,7 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: none</p>
     <li data-md>
-     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
+     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥①">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> of this specification</p>
    </ul>
@@ -8555,7 +8757,7 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥①">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥②">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
@@ -8566,14 +8768,14 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: appidExclude</p>
     <li data-md>
-     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥②">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥③">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.1.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
      <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥③">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥④">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
@@ -8586,9 +8788,9 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
-The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥④">WebAuthn Relying Party</a>'s
+The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑤">WebAuthn Relying Party</a>'s
 computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②①">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Parties</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Parties</a>.
 Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
 Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> security characteristics.</p>
@@ -8600,7 +8802,7 @@ <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><s
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
 This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑤">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertion</a>), and thus the interaction would end in an error.</p>
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑥">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
    <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a>.
 This arrangement has some important advantages.</p>
@@ -8632,7 +8834,7 @@ <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span c
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer that
 has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
-intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑥">WebAuthn Relying Parties</a> MUST update their trusted root certificates
+intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑦">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
@@ -8642,7 +8844,7 @@ <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span cl
    <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
    <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
-   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑦">WebAuthn Relying Parties</a> by this specification include:</p>
+   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑧">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
@@ -8651,8 +8853,8 @@ <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span clas
 any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> can optionally
 enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
-Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
+     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
+Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
 methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a>.</p>
@@ -8679,7 +8881,7 @@ <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenge
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
    <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑧">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> qualities.
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> qualities.
 For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a>, on its own,
 provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a> was generated
@@ -8687,13 +8889,13 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
 For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> script.
 The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③②">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
 same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> and passing through the same attacker.</p>
    <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a>: unscathed
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
    <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
 a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> reports
@@ -8719,19 +8921,19 @@ <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mob
 different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
-For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a> by providing only a username,
+For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> by providing only a username,
 and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>.
 The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②②">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
 which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
@@ -8815,7 +9017,7 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
    <ul>
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑨">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
 private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>.</p>
     <li data-md>
      <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
@@ -8835,7 +9037,7 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
 prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⓪">WebAuthn Relying Party</a> to enable strong
+   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦①">WebAuthn Relying Party</a> to enable strong
 authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Parties</a>.</p>
    <ul>
     <li data-md>
@@ -8860,7 +9062,7 @@ <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credenti
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
    <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
 authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑦">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦①">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> therefore cannot discover the
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> therefore cannot discover the
 user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> cannot expose biometric data for an attacker to
 use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Parties</a>.</p>
    <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑦">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
@@ -8892,7 +9094,7 @@ <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><s
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①②⑧">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③③">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③③">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication
 ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> has been
 performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a> SHOULD NOT store personally identifying information.</p>
    <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①①">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑨">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
@@ -8900,7 +9102,7 @@ <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span clas
    <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①③⓪">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>:</p>
    <ul>
     <li data-md>
      <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> are present.</p>
@@ -8916,7 +9118,7 @@ <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credential</a> is not available.</p>
@@ -8926,19 +9128,19 @@ <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><spa
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧④">credentials</a> are available.
 For example, one such information leak may happen if the client displays instructions and controls
-for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a>.
+for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a>.
 In this case, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> is aware of this <a data-link-type="dfn" href="#client" id="ref-for-client①③①">client</a> behavior,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⑤">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> parameter is
 available to the user.</p>
-   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> at any time,
+   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> at any time,
 regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑤">credentials</a> are available.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
    <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
@@ -8949,25 +9151,25 @@ <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><s
 function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> might leak sensitive
 information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
 initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
 is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> has thus leaked the possibly sensitive information that
 "j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a>.</p>
    <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
 mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Parties</a>.</p>
        </ul>
@@ -8975,7 +9177,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑧">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
 send a message to this address, containing an unpredictable one-time code and instructions for how to use it to
 proceed with the ceremony. Display the same message to the user in the web interface regardless of the contents of the
 sent e-mail and whether or not this e-mail address was already registered.</p>
@@ -8985,10 +9187,10 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
@@ -9001,7 +9203,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
 before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
@@ -9009,7 +9211,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> argument risks leaking personally identifying information,
 since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Parties</a>,
@@ -9024,7 +9226,7 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑥">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
     <li data-md>
      <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
 so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> argument is not needed.</p>
@@ -9033,13 +9235,13 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑨">allowCredentials</a></code> needs to be exposed given only a username,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <p>When <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑥">signalling</a> that a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥①">credential id</a> was not recognized,
-the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
+the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑦">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
 exposing <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥②">credential IDs</a> to an unauthenticated caller.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
    <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑨">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑦">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -11159,7 +11361,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "3610bd67": {"dfnID":"3610bd67","dfnText":"allowed to use","external":true,"refSections":[{"refs":[{"id":"ref-for-allowed-to-use"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-allowed-to-use\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-allowed-to-use\u2461"},{"id":"ref-for-allowed-to-use\u2462"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use"},
 "36858240": {"dfnID":"36858240","dfnText":"boolean","external":true,"refSections":[{"refs":[{"id":"ref-for-boolean"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-boolean\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"https://infra.spec.whatwg.org/#boolean"},
 "38a4f3d4": {"dfnID":"38a4f3d4","dfnText":"something you are","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"3aff2fb3": {"dfnID":"3aff2fb3","dfnText":"BufferSource","external":true,"refSections":[{"refs":[{"id":"ref-for-BufferSource"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2461"},{"id":"ref-for-BufferSource\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2463"},{"id":"ref-for-BufferSource\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-BufferSource\u2465"},{"id":"ref-for-BufferSource\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2467"},{"id":"ref-for-BufferSource\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u24ea"},{"id":"ref-for-BufferSource\u2460\u2460"},{"id":"ref-for-BufferSource\u2460\u2461"},{"id":"ref-for-BufferSource\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2463"},{"id":"ref-for-BufferSource\u2460\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#BufferSource"},
+"3aff2fb3": {"dfnID":"3aff2fb3","dfnText":"BufferSource","external":true,"refSections":[{"refs":[{"id":"ref-for-BufferSource"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-BufferSource\u2461"},{"id":"ref-for-BufferSource\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2463"},{"id":"ref-for-BufferSource\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-BufferSource\u2465"},{"id":"ref-for-BufferSource\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-BufferSource\u2467"},{"id":"ref-for-BufferSource\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u24ea"},{"id":"ref-for-BufferSource\u2460\u2460"},{"id":"ref-for-BufferSource\u2460\u2461"},{"id":"ref-for-BufferSource\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2463"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-BufferSource\u2460\u2464"},{"id":"ref-for-BufferSource\u2460\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#BufferSource"},
 "3b90bdcd": {"dfnID":"3b90bdcd","dfnText":"resolve","external":true,"refSections":[{"refs":[{"id":"ref-for-resolve"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#resolve"},
 "3de9e659": {"dfnID":"3de9e659","dfnText":"byte sequence","external":true,"refSections":[{"refs":[{"id":"ref-for-byte-sequence"},{"id":"ref-for-byte-sequence\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-byte-sequence\u2461"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"https://infra.spec.whatwg.org/#byte-sequence"},
 "3e12e042": {"dfnID":"3e12e042","dfnText":"environment settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-environment-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-environment-settings-object\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"},
@@ -11322,7 +11524,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authdata-signcount": {"dfnID":"authdata-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-signcount"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-signcount\u2460"},{"id":"ref-for-authdata-signcount\u2461"},{"id":"ref-for-authdata-signcount\u2462"},{"id":"ref-for-authdata-signcount\u2463"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authdata-signcount\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-signcount\u2465"},{"id":"ref-for-authdata-signcount\u2466"},{"id":"ref-for-authdata-signcount\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-signcount"},
 "authentication": {"dfnID":"authentication","dfnText":"Authentication","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication"},{"id":"ref-for-authentication\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authentication\u2462"},{"id":"ref-for-authentication\u2463"},{"id":"ref-for-authentication\u2464"},{"id":"ref-for-authentication\u2465"},{"id":"ref-for-authentication\u2466"},{"id":"ref-for-authentication\u2467"},{"id":"ref-for-authentication\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authentication\u2460\u2460"},{"id":"ref-for-authentication\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication\u2460\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authentication\u2460\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authentication\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authentication\u2460\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication\u2460\u2468"}],"title":"16. Acknowledgements"}],"url":"#authentication"},
 "authentication-assertion": {"dfnID":"authentication-assertion","dfnText":"Authentication Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-assertion"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication-assertion\u2460"},{"id":"ref-for-authentication-assertion\u2461"},{"id":"ref-for-authentication-assertion\u2462"},{"id":"ref-for-authentication-assertion\u2463"},{"id":"ref-for-authentication-assertion\u2464"},{"id":"ref-for-authentication-assertion\u2465"},{"id":"ref-for-authentication-assertion\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-assertion\u2467"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-assertion\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2464"},{"id":"ref-for-authentication-assertion\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#authentication-assertion"},
-"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"},{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"},{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2462"},{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
+"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"},{"id":"ref-for-authentication-ceremony\u2463\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"},{"id":"ref-for-authentication-ceremony\u2463\u2465"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"},{"id":"ref-for-authentication-ceremony\u2464\u2462"},{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"},{"id":"ref-for-authentication-ceremony\u2464\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
 "authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2460"},{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"},{"id":"ref-for-authentication-extension\u2460\u2467"},{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u24ea"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2460"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
 "authentication-factor-capability": {"dfnID":"authentication-factor-capability","dfnText":"Authentication Factor Capability","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-factor-capability"},{"id":"ref-for-authentication-factor-capability\u2460"},{"id":"ref-for-authentication-factor-capability\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authentication-factor-capability"},
 "authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2462"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2464"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u24ea"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2460"},{"id":"ref-for-authenticator\u2462\u2463\u2461"},{"id":"ref-for-authenticator\u2462\u2463\u2462"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2463"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
@@ -11514,12 +11716,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-authenticationextensionslargebloboutputs-blob": {"dfnID":"dom-authenticationextensionslargebloboutputs-blob","dfnText":"blob","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob\u2460"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-blob\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-blob"},
 "dom-authenticationextensionslargebloboutputs-supported": {"dfnID":"dom-authenticationextensionslargebloboutputs-supported","dfnText":"supported","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported\u2460"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-supported\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-supported"},
 "dom-authenticationextensionslargebloboutputs-written": {"dfnID":"dom-authenticationextensionslargebloboutputs-written","dfnText":"written","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargebloboutputs-written"},{"id":"ref-for-dom-authenticationextensionslargebloboutputs-written\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargebloboutputs-written"},
-"dom-authenticationextensionsprfinputs-eval": {"dfnID":"dom-authenticationextensionsprfinputs-eval","dfnText":"eval","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2464"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2465"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2466"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfinputs-eval"},
-"dom-authenticationextensionsprfinputs-evalbycredential": {"dfnID":"dom-authenticationextensionsprfinputs-evalbycredential","dfnText":"evalByCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
-"dom-authenticationextensionsprfoutputs-enabled": {"dfnID":"dom-authenticationextensionsprfoutputs-enabled","dfnText":"enabled","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfoutputs-enabled"},
-"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
-"dom-authenticationextensionsprfvalues-first": {"dfnID":"dom-authenticationextensionsprfvalues-first","dfnText":"first","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfvalues-first"},
-"dom-authenticationextensionsprfvalues-second": {"dfnID":"dom-authenticationextensionsprfvalues-second","dfnText":"second","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsprfvalues-second"},
+"dom-authenticationextensionsprfinputs-eval": {"dfnID":"dom-authenticationextensionsprfinputs-eval","dfnText":"eval","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2464"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2465"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2466"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2468"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-eval"},
+"dom-authenticationextensionsprfinputs-evalbycredential": {"dfnID":"dom-authenticationextensionsprfinputs-evalbycredential","dfnText":"evalByCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2465"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
+"dom-authenticationextensionsprfoutputs-enabled": {"dfnID":"dom-authenticationextensionsprfoutputs-enabled","dfnText":"enabled","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2462"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfoutputs-enabled"},
+"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2462"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2463"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2464"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2465"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2466"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
+"dom-authenticationextensionsprfvalues-first": {"dfnID":"dom-authenticationextensionsprfvalues-first","dfnText":"first","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2462"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2463"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2465"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-first"},
+"dom-authenticationextensionsprfvalues-second": {"dfnID":"dom-authenticationextensionsprfvalues-second","dfnText":"second","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2463"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2465"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2466"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2467"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2468"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460\u24ea"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-second"},
 "dom-authenticationresponsejson-authenticatorattachment": {"dfnID":"dom-authenticationresponsejson-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-authenticatorattachment"},
 "dom-authenticationresponsejson-clientextensionresults": {"dfnID":"dom-authenticationresponsejson-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationresponsejson-clientextensionresults"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-authenticationresponsejson-clientextensionresults"},
 "dom-authenticationresponsejson-id": {"dfnID":"dom-authenticationresponsejson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-id"},
@@ -11747,7 +11949,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "platform-attachment": {"dfnID":"platform-attachment","dfnText":"platform attachment","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-attachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-attachment\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-attachment\u2461"},{"id":"ref-for-platform-attachment\u2462"},{"id":"ref-for-platform-attachment\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-attachment\u2464"}],"title":"11.2. Virtual Authenticators"}],"url":"#platform-attachment"},
 "platform-authenticators": {"dfnID":"platform-authenticators","dfnText":"platform authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-platform-authenticators\u2460"},{"id":"ref-for-platform-authenticators\u2461"},{"id":"ref-for-platform-authenticators\u2462"},{"id":"ref-for-platform-authenticators\u2463"},{"id":"ref-for-platform-authenticators\u2464"},{"id":"ref-for-platform-authenticators\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2466"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-platform-authenticators\u2468"},{"id":"ref-for-platform-authenticators\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2460"},{"id":"ref-for-platform-authenticators\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2463"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2464"},{"id":"ref-for-platform-authenticators\u2460\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2466"},{"id":"ref-for-platform-authenticators\u2460\u2467"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2468"},{"id":"ref-for-platform-authenticators\u2461\u24ea"},{"id":"ref-for-platform-authenticators\u2461\u2460"},{"id":"ref-for-platform-authenticators\u2461\u2461"},{"id":"ref-for-platform-authenticators\u2461\u2462"},{"id":"ref-for-platform-authenticators\u2461\u2463"},{"id":"ref-for-platform-authenticators\u2461\u2464"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2467"},{"id":"ref-for-platform-authenticators\u2461\u2468"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u24ea"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2463"},{"id":"ref-for-platform-authenticators\u2462\u2464"}],"title":"14.5.3. Privacy Between Operating System Accounts"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2465"}],"title":"15. Accessibility Considerations"}],"url":"#platform-authenticators"},
 "platform-credential": {"dfnID":"platform-credential","dfnText":"platform credential","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-credential\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-credential\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-platform-credential\u2462"},{"id":"ref-for-platform-credential\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#platform-credential"},
-"prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
+"prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-prf\u2461"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-prf\u2462"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
 "public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"},{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2466"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2467"},{"id":"ref-for-public-key-credential\u2462\u2468"},{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2462"},{"id":"ref-for-public-key-credential\u2463\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"},{"id":"ref-for-public-key-credential\u2463\u2467"},{"id":"ref-for-public-key-credential\u2463\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"},{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"},{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"},{"id":"ref-for-public-key-credential\u2465\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"},{"id":"ref-for-public-key-credential\u2466\u2463"},{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"},{"id":"ref-for-public-key-credential\u2467\u2462"},{"id":"ref-for-public-key-credential\u2467\u2463"},{"id":"ref-for-public-key-credential\u2467\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},
 "public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"},{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"},{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"},{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"},{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"},{"id":"ref-for-public-key-credential-source\u2465\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2461"},{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2464"},{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2468"},{"id":"ref-for-public-key-credential-source\u2466\u24ea"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2460"},{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"},{"id":"ref-for-public-key-credential-source\u2466\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2467"},{"id":"ref-for-public-key-credential-source\u2466\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u24ea"},{"id":"ref-for-public-key-credential-source\u2467\u2460"},{"id":"ref-for-public-key-credential-source\u2467\u2461"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2462"},{"id":"ref-for-public-key-credential-source\u2467\u2463"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2464"},{"id":"ref-for-public-key-credential-source\u2467\u2465"},{"id":"ref-for-public-key-credential-source\u2467\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
 "public-key-credential-source-id": {"dfnID":"public-key-credential-source-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-id"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2461"},{"id":"ref-for-public-key-credential-source-id\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2466"},{"id":"ref-for-public-key-credential-source-id\u2467"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-id"},
@@ -11766,7 +11968,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
 "registrable-origin-label": {"dfnID":"registrable-origin-label","dfnText":"Registrable Origin Label","external":false,"refSections":[{"refs":[{"id":"ref-for-registrable-origin-label"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registrable-origin-label\u2460"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-registrable-origin-label\u2461"},{"id":"ref-for-registrable-origin-label\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"#registrable-origin-label"},
 "registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
-"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
+"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"},{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2462"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"},{"id":"ref-for-registration-ceremony\u2461\u2466"},{"id":"ref-for-registration-ceremony\u2461\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2468"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
 "registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"},{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
 "relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"},{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"},{"id":"ref-for-relying-party\u2460\u2462\u2468"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"},{"id":"ref-for-relying-party\u2460\u2463\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"},{"id":"ref-for-relying-party\u2460\u2463\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2465"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"},{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2465"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"},{"id":"ref-for-relying-party\u2460\u2468\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"},{"id":"ref-for-relying-party\u2461\u2460\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"},{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2461\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2468"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u24ea"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"},{"id":"ref-for-relying-party\u2461\u2468\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2461"},{"id":"ref-for-relying-party\u2461\u2468\u2462"}],"title":"8.2.1. Certificate Requirements for Packed Attestation Statements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"},{"id":"ref-for-relying-party\u2461\u2468\u2467"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"},{"id":"ref-for-relying-party\u2462\u24ea\u2461"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2462"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"},{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"},{"id":"ref-for-relying-party\u2462\u24ea\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2468"},{"id":"ref-for-relying-party\u2462\u2460\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"},{"id":"ref-for-relying-party\u2462\u2460\u2468"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"},{"id":"ref-for-relying-party\u2462\u2462\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2462\u2468"},{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"},{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"},{"id":"ref-for-relying-party\u2462\u2465\u24ea"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"},{"id":"ref-for-relying-party\u2462\u2465\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2461"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"},{"id":"ref-for-relying-party\u2462\u2467\u2468"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"},{"id":"ref-for-relying-party\u2463\u24ea\u24ea"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"},{"id":"ref-for-relying-party\u2463\u24ea\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2462"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2463"},{"id":"ref-for-relying-party\u2463\u2460\u2464"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2462"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},
@@ -11820,11 +12022,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "web-application": {"dfnID":"web-application","dfnText":"web application","external":false,"refSections":[{"refs":[{"id":"ref-for-web-application\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-application\u2461"},{"id":"ref-for-web-application\u2462"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-web-application\u2463"}],"title":"11. User Agent Automation"},{"refs":[{"id":"ref-for-web-application\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-web-application\u2465"}],"title":"13. Security Considerations"}],"url":"#web-application"},
 "web-authentication-api": {"dfnID":"web-authentication-api","dfnText":"Web Authentication API","external":false,"refSections":[{"refs":[{"id":"ref-for-web-authentication-api"},{"id":"ref-for-web-authentication-api\u2460"},{"id":"ref-for-web-authentication-api\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-authentication-api\u2462"},{"id":"ref-for-web-authentication-api\u2463"},{"id":"ref-for-web-authentication-api\u2464"},{"id":"ref-for-web-authentication-api\u2465"},{"id":"ref-for-web-authentication-api\u2466"},{"id":"ref-for-web-authentication-api\u2467"},{"id":"ref-for-web-authentication-api\u2468"},{"id":"ref-for-web-authentication-api\u2460\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2464"},{"id":"ref-for-web-authentication-api\u2460\u2465"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2467"},{"id":"ref-for-web-authentication-api\u2460\u2468"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#web-authentication-api"},
 "webauthn-authenticator": {"dfnID":"webauthn-authenticator","dfnText":"WebAuthn Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-authenticator"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461"},{"id":"ref-for-webauthn-authenticator\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2463"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2465"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2466"},{"id":"ref-for-webauthn-authenticator\u2467"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2460"},{"id":"ref-for-webauthn-authenticator\u2460\u2461"}],"title":"13.3.1. Attestation Certificate Hierarchy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2462"},{"id":"ref-for-webauthn-authenticator\u2460\u2463"},{"id":"ref-for-webauthn-authenticator\u2460\u2464"},{"id":"ref-for-webauthn-authenticator\u2460\u2465"},{"id":"ref-for-webauthn-authenticator\u2460\u2466"},{"id":"ref-for-webauthn-authenticator\u2460\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2468"},{"id":"ref-for-webauthn-authenticator\u2461\u24ea"}],"title":"14.4.1. Attestation Privacy"}],"url":"#webauthn-authenticator"},
-"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"},{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"},{"id":"ref-for-webauthn-client\u2460\u2466"},{"id":"ref-for-webauthn-client\u2460\u2467"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2468"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u24ea"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2461"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
+"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"},{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"},{"id":"ref-for-webauthn-client\u2460\u2466"},{"id":"ref-for-webauthn-client\u2460\u2467"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2468"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u24ea"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2461"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2463"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
 "webauthn-client-device": {"dfnID":"webauthn-client-device","dfnText":"WebAuthn Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client-device"},{"id":"ref-for-webauthn-client-device\u2460"}],"title":"4. Terminology"}],"url":"#webauthn-client-device"},
 "webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2468"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u24ea"},{"id":"ref-for-webauthn-extensions\u2460\u2460"},{"id":"ref-for-webauthn-extensions\u2460\u2461"}],"title":"9. WebAuthn Extensions"}],"url":"#webauthn-extensions"},
 "webauthn-fido2-protocol": {"dfnID":"webauthn-fido2-protocol","dfnText":"WebAuthn/FIDO2 protocol","external":false,"refSections":[],"url":"#webauthn-fido2-protocol"},
-"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"},{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"},{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"},{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"},{"id":"ref-for-webauthn-relying-party\u2461\u2463"},{"id":"ref-for-webauthn-relying-party\u2461\u2464"},{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"},{"id":"ref-for-webauthn-relying-party\u2461\u2467"},{"id":"ref-for-webauthn-relying-party\u2461\u2468"},{"id":"ref-for-webauthn-relying-party\u2462\u24ea"},{"id":"ref-for-webauthn-relying-party\u2462\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2461"},{"id":"ref-for-webauthn-relying-party\u2462\u2462"},{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"},{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u24ea"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2460"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2461"},{"id":"ref-for-webauthn-relying-party\u2465\u2462"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2463"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2465"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2468"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u24ea"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2460"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2462"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2463"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#webauthn-relying-party"},
+"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"},{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"},{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"},{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"},{"id":"ref-for-webauthn-relying-party\u2461\u2463"},{"id":"ref-for-webauthn-relying-party\u2461\u2464"},{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"},{"id":"ref-for-webauthn-relying-party\u2461\u2467"},{"id":"ref-for-webauthn-relying-party\u2461\u2468"},{"id":"ref-for-webauthn-relying-party\u2462\u24ea"},{"id":"ref-for-webauthn-relying-party\u2462\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2461"},{"id":"ref-for-webauthn-relying-party\u2462\u2462"},{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"},{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u24ea"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2460"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2461"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2462"},{"id":"ref-for-webauthn-relying-party\u2465\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2465"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2466"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2464"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2466\u2466"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#webauthn-relying-party"},
 "webauthn-signature": {"dfnID":"webauthn-signature","dfnText":"WebAuthn signature","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-signature"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-signature\u2460"}],"title":"6. WebAuthn Authenticator Model"}],"url":"#webauthn-signature"},
 };