From 1b8ac2f107d5601000f8d094c20ee0d298fffa52 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Thu, 14 Nov 2024 13:02:19 +0000
Subject: [PATCH] Merge pull request #2199 from
 w3c/ve7jtb-Fix-2198-WebAuthn-Clients-should-NOT-zero-out-AAGUIDs-from-security-keys-when-attestation-is-none-

SHA: 654d38406a07133d2788a316f4f590a40578159b
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 86 ++++++++++++++++++++++++++----------------------------
 1 file changed, 42 insertions(+), 44 deletions(-)

diff --git a/index.html b/index.html
index 755896790..d7da89168 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 742f3d674, updated Mon Nov 4 14:56:54 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="814e03a24c87b89e3500758370f572038ff9a10f" name="revision">
+  <meta content="654d38406a07133d2788a316f4f590a40578159b" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-11-13">13 November 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-11-14">14 November 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -3025,13 +3025,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                 <ol>
                  <li data-md>
                   <p>Set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult②">attestationObjectResult</a>.fmt</code> to "none", and set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult③">attestationObjectResult</a>.attStmt</code> to be an empty <a data-link-type="dfn" href="#cbor" id="ref-for-cbor③">CBOR</a> map. (See <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> and <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>).</p>
-                 <li data-md>
-                  <p>If <var>authenticator</var> is not a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a> then replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
                 </ol>
               </ol>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect">indirect</a></code>
              <dd data-md>
-              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a> with a more privacy-friendly
+              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a> with a more privacy-friendly
 and/or more easily verifiable version of the same data (for example, by employing an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca">Anonymization CA</a>).</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-direct" id="ref-for-dom-attestationconveyancepreference-direct">direct</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise①">enterprise</a></code>
              <dd data-md>
@@ -3066,7 +3064,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                 <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
                 <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> behavior may be suboptimal.</p>
                 <p>If the user agent does not have any transport information, it SHOULD set this field to the empty sequence.</p>
-                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform authenticator</a>.</p>
+                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a>.</p>
               </dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot①">[[clientExtensionsResults]]</a></code>
              <dd data-md>
@@ -3349,7 +3347,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
 and no <var>authenticator</var> will become available for any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑧">public key credentials</a> therein,
        <dd data-md>
         <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
        <dt data-md>If an <var>authenticator</var> becomes available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①④">client device</a>,
        <dd data-md>
         <p class="note" role="note"><span class="marker">Note:</span> This includes the case where an <var>authenticator</var> was available upon <var>lifetimeTimer</var> initiation.</p>
@@ -4888,7 +4886,7 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;internal&quot;|internal" id="dom-authenticatortransport-internal"><code>internal</code></dfn>
      <dd data-md>
       <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
-i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a>.
+i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform authenticator</a>.
 These authenticators are not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑨">client device</a>.</p>
     </dl>
    </div>
@@ -5009,11 +5007,11 @@ <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secn
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhint-client-device"><code>client-device</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhint-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -5227,10 +5225,10 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
          <li data-md>
           <p>Bit 5: Reserved for future use (<code>RFU2</code>).</p>
          <li data-md>
-          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">Attested credential data</a> included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-at">AT</dfn>).</p>
+          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">Attested credential data</a> included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-at">AT</dfn>).</p>
           <ul>
            <li data-md>
-            <p>Indicates whether the authenticator added <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data③">attested credential data</a>.</p>
+            <p>Indicates whether the authenticator added <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">attested credential data</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 7: Extension data included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-ed">ED</dfn>).</p>
@@ -5246,7 +5244,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata">attestedCredentialData</dfn>
        <td>variable (if present)
-       <td> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data④">attested credential data</a> (if present). See <a href="#sctn-attested-credential-data">§ 6.5.1 Attested Credential Data</a> for details. Its length depends on
+       <td> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data③">attested credential data</a> (if present). See <a href="#sctn-attested-credential-data">§ 6.5.1 Attested Credential Data</a> for details. Its length depends on
                 the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength">length</a> of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid①">credential ID</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey①">credential public
                 key</a> being attested. 
       <tr>
@@ -5294,9 +5292,9 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </figure>
    <div class="note" role="note">
      Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flags</a> are not set, it is always 37 bytes long.
-    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
+    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data④">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
     follows. 
-    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>).</p>
+    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>).</p>
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
@@ -5387,7 +5385,7 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
      <p>When authenticating for the first time on a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②③">client device</a>, a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑨">roaming authenticator</a> is typically needed
 since the user doesn’t yet have a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential①">platform credential</a> on that <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②④">client device</a>.</p>
     <li data-md>
-     <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform authenticator</a> is likely the most convenient
+     <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> is likely the most convenient
 since it’s built directly into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑥">client device</a> rather than being a separate device that the user may have to locate.</p>
     <li data-md>
      <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> can be used.</p>
@@ -5400,7 +5398,7 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform</a> authenticator,
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform</a> authenticator,
 or in some cases both — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a>.</p>
     <li data-md>
@@ -5480,26 +5478,26 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client
-device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
+     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client
+device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑤">roaming authenticator</a> is attached using cross-platform transports, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cross-platform-attachment">cross-platform attachment</dfn>. Authenticators of this class are removable from, and
 can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
 credential</dfn>.</p>
    </ul>
-   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
+   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticator</a>,
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
 while <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
 would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a>.</p>
-   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
+   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
 This gives the user the convenience benefit
 of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremonies</a>, e.g., the user will not have to dig around in
 their pocket for their key fob or phone.</p>
    <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> shared between multiple users,
-or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a>;
+or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a>;
 and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
 backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> is lost.</p>
@@ -5721,7 +5719,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        <p>let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑨">signature counter</a> value for the new credential be constant at zero.</p>
      </dl>
     <li data-md>
-     <p>Let <var>attestedCredentialData</var> be the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑧">attested credential data</a> byte array including the <var>credentialId</var> and <var>publicKey</var>.</p>
+     <p>Let <var>attestedCredentialData</var> be the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a> byte array including the <var>credentialId</var> and <var>publicKey</var>.</p>
     <li data-md>
      <p>Let <var>attestationFormat</var> be the first supported <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier">attestation statement format identifier</a> from <var>attestationFormats</var>, taking into account <var>enterpriseAttestationPossible</var>.
 If <var>attestationFormats</var> contains no supported value, then let <var>attestationFormat</var> be the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier①">attestation statement format identifier</a> most preferred by this authenticator.</p>
@@ -5950,13 +5948,13 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
 enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
-or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑧">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
    <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
 for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to base a trust decision on.
 In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
-    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
+    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential
     data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a>.</figcaption>
    </figure>
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③">attestation statement
@@ -6027,8 +6025,8 @@ <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data
                 relevant key type specification, i.e., REQUIRED for the key type "kty" and algorithm "alg"
                 (see <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#section-2" id="ref-for-section-2">Section 2</a> of <a data-link-type="biblio" href="#biblio-rfc9053" title="CBOR Object Signing and Encryption (COSE): Initial Algorithms">[RFC9053]</a>). 
     </table>
-    <figcaption> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">Attested credential data</a> layout. The names in the Name column are only for reference within this document, and are not
-        present in the actual representation of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①②">attested credential data</a>. </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">Attested credential data</a> layout. The names in the Name column are only for reference within this document, and are not
+        present in the actual representation of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">attested credential data</a>. </figcaption>
    </figure>
    <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-examples"><span class="secno">6.5.1.1. </span><span class="content">Examples of <code>credentialPublicKey</code> Values Encoded in COSE_Key Format</span><a class="self-link" href="#sctn-encoded-credPubKey-examples"></a></h5>
    <p>This section provides examples of COSE_Key-encoded Elliptic Curve and RSA public keys for the ES256, PS256, and RS256
@@ -6315,7 +6313,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
     <li id="reg-ceremony-attestation-trust-anchors"><a class="self-link" href="#reg-ceremony-attestation-trust-anchors"></a> If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates)
     for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. For
-    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
+    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
     <li id="reg-ceremony-assess-trust">
      <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 21</a>, as follows: 
      <ul>
@@ -6651,7 +6649,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
          <p>Verify that <var>attestnCert</var> meets the requirements in <a href="#sctn-packed-attestation-cert-requirements">§ 8.2.1 Certificate Requirements for Packed Attestation Statements</a>.</p>
         <li data-md>
          <p>If <var>attestnCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the
-value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">aaguid</a></code> in <var>authenticatorData</var>.</p>
+value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">aaguid</a></code> in <var>authenticatorData</var>.</p>
         <li data-md>
          <p>Optionally, inspect <var>x5c</var> and consult externally provided knowledge to determine whether <var>attStmt</var> conveys a <a data-link-type="dfn" href="#basic" id="ref-for-basic③">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca③">AttCA</a> attestation.</p>
         <li data-md>
@@ -6817,7 +6815,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>Verify that <var>aikCert</var> meets the requirements in <a href="#sctn-tpm-cert-requirements">§ 8.3.1 TPM Attestation Statement Certificate Requirements</a>.</p>
       <li data-md>
        <p>If <var>aikCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the value of this
-extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑥">aaguid</a></code> in <var>authenticatorData</var>.</p>
+extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">aaguid</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
        <p>Verify the <var>sig</var> is a valid signature over <var>certInfo</var> using the attestation public key in <var>aikCert</var> with the
 algorithm specified in <var>alg</var>.</p>
@@ -6866,7 +6864,7 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
@@ -6944,7 +6942,7 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
    <p class="note" role="note"><span class="marker">Note:</span> This format is deprecated and is expected to be removed in a future revision of this document.</p>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -8712,14 +8710,14 @@ <h3 class="heading settled" data-level="12.1" id="sctn-att-fmt-reg-update"><span
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-key</p>
     <li data-md>
-     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
+     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
 attestation" statement.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-key-attestation">§ 8.4 Android Key Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-safetynet</p>
     <li data-md>
-     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform authenticators</a> MAY produce an attestation statement based on the Android
+     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">platform authenticators</a> MAY produce an attestation statement based on the Android
 SafetyNet API.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-safetynet-attestation">§ 8.5 Android SafetyNet Attestation Statement Format</a> of this specification <br><br></p>
@@ -8736,7 +8734,7 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: apple</p>
     <li data-md>
-     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a></p>
+     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform authenticators</a></p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-apple-anonymous-attestation">§ 8.8 Apple Anonymous Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
@@ -9020,7 +9018,7 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
      <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> depending on the implementation.</p>
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> depending on the implementation.</p>
     <li data-md>
      <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticators</a>, e.g., product names.</p>
      <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
@@ -9055,7 +9053,7 @@ <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credenti
 This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user account</a> without a traditional username,
 further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
 authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a>, depending on the implementation. Biometric data is
 not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> therefore cannot discover the
 user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> cannot expose biometric data for an attacker to
@@ -9106,7 +9104,7 @@ <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy
    </ul>
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
 before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
@@ -9131,7 +9129,7 @@ <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><spa
    <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> at any time,
 regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑥">credentials</a> are available.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
-   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform
+   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
@@ -9233,7 +9231,7 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
 the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑦">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
 exposing <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥②">credential IDs</a> to an unauthenticated caller.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
    <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
@@ -11488,9 +11486,9 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "attestation-statement-format-identifier": {"dfnID":"attestation-statement-format-identifier","dfnText":"attestation statement format identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format-identifier"},{"id":"ref-for-attestation-statement-format-identifier\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2461"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2462"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2463"}],"title":"8.1. Attestation Statement Format Identifiers"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2464"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#attestation-statement-format-identifier"},
 "attestation-trust-path": {"dfnID":"attestation-trust-path","dfnText":"attestation trust path","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-trust-path"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-trust-path\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-trust-path\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-trust-path\u2462"},{"id":"ref-for-attestation-trust-path\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2464"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2468"}],"title":"8.7. None Attestation Statement Format"}],"url":"#attestation-trust-path"},
 "attestation-type": {"dfnID":"attestation-type","dfnText":"attestation type","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-type"},{"id":"ref-for-attestation-type\u2460"},{"id":"ref-for-attestation-type\u2461"},{"id":"ref-for-attestation-type\u2462"},{"id":"ref-for-attestation-type\u2463"},{"id":"ref-for-attestation-type\u2464"},{"id":"ref-for-attestation-type\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-type\u2466"},{"id":"ref-for-attestation-type\u2467"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-type\u2468"},{"id":"ref-for-attestation-type\u2460\u24ea"},{"id":"ref-for-attestation-type\u2460\u2460"},{"id":"ref-for-attestation-type\u2460\u2461"},{"id":"ref-for-attestation-type\u2460\u2462"},{"id":"ref-for-attestation-type\u2460\u2463"},{"id":"ref-for-attestation-type\u2460\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2466"},{"id":"ref-for-attestation-type\u2460\u2467"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2460\u2468"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2462"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-type\u2461\u2463"},{"id":"ref-for-attestation-type\u2461\u2464"}],"title":"13.4.4. Attestation Limitations"}],"url":"#attestation-type"},
-"attested-credential-data": {"dfnID":"attested-credential-data","dfnText":"Attested credential data","external":false,"refSections":[{"refs":[{"id":"ref-for-attested-credential-data"},{"id":"ref-for-attested-credential-data\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attested-credential-data\u2461"},{"id":"ref-for-attested-credential-data\u2462"},{"id":"ref-for-attested-credential-data\u2463"},{"id":"ref-for-attested-credential-data\u2464"},{"id":"ref-for-attested-credential-data\u2465"},{"id":"ref-for-attested-credential-data\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attested-credential-data\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attested-credential-data\u2468"},{"id":"ref-for-attested-credential-data\u2460\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u2460"},{"id":"ref-for-attested-credential-data\u2460\u2461"}],"title":"6.5.1. Attested Credential Data"}],"url":"#attested-credential-data"},
+"attested-credential-data": {"dfnID":"attested-credential-data","dfnText":"Attested credential data","external":false,"refSections":[{"refs":[{"id":"ref-for-attested-credential-data"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attested-credential-data\u2460"},{"id":"ref-for-attested-credential-data\u2461"},{"id":"ref-for-attested-credential-data\u2462"},{"id":"ref-for-attested-credential-data\u2463"},{"id":"ref-for-attested-credential-data\u2464"},{"id":"ref-for-attested-credential-data\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attested-credential-data\u2466"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attested-credential-data\u2467"},{"id":"ref-for-attested-credential-data\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attested-credential-data\u2460\u24ea"},{"id":"ref-for-attested-credential-data\u2460\u2460"}],"title":"6.5.1. Attested Credential Data"}],"url":"#attested-credential-data"},
 "authdata-attestedcredentialdata": {"dfnID":"authdata-attestedcredentialdata","dfnText":"attestedCredentialData","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2461"},{"id":"ref-for-authdata-attestedcredentialdata\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2463"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata\u2460\u24ea"},{"id":"ref-for-authdata-attestedcredentialdata\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata"},
-"authdata-attestedcredentialdata-aaguid": {"dfnID":"authdata-attestedcredentialdata-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2464"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2465"}],"title":"8.3. TPM Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-aaguid"},
+"authdata-attestedcredentialdata-aaguid": {"dfnID":"authdata-attestedcredentialdata-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-aaguid\u2464"}],"title":"8.3. TPM Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-aaguid"},
 "authdata-attestedcredentialdata-credentialid": {"dfnID":"authdata-attestedcredentialdata-credentialid","dfnText":"credentialId","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2462"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2463"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2464"},{"id":"ref-for-authdata-attestedcredentialdata-credentialid\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#authdata-attestedcredentialdata-credentialid"},
 "authdata-attestedcredentialdata-credentialidlength": {"dfnID":"authdata-attestedcredentialdata-credentialidlength","dfnText":"credentialIdLength","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength"},{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength\u2460"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-attestedcredentialdata-credentialidlength"},
 "authdata-attestedcredentialdata-credentialpublickey": {"dfnID":"authdata-attestedcredentialdata-credentialpublickey","dfnText":"credentialPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}],"title":"8.4. Android Key Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-credentialpublickey"},
@@ -11929,7 +11927,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "passkey-platform-authenticator": {"dfnID":"passkey-platform-authenticator","dfnText":"Passkey platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey-platform-authenticator"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-passkey-platform-authenticator\u2460"},{"id":"ref-for-passkey-platform-authenticator\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#passkey-platform-authenticator"},
 "passkey-roaming-authenticator": {"dfnID":"passkey-roaming-authenticator","dfnText":"Passkey roaming authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-passkey-roaming-authenticator"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-passkey-roaming-authenticator\u2460"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#passkey-roaming-authenticator"},
 "platform-attachment": {"dfnID":"platform-attachment","dfnText":"platform attachment","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-attachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-attachment\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-attachment\u2461"},{"id":"ref-for-platform-attachment\u2462"},{"id":"ref-for-platform-attachment\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-attachment\u2464"}],"title":"11.2. Virtual Authenticators"}],"url":"#platform-attachment"},
-"platform-authenticators": {"dfnID":"platform-authenticators","dfnText":"platform authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-platform-authenticators\u2460"},{"id":"ref-for-platform-authenticators\u2461"},{"id":"ref-for-platform-authenticators\u2462"},{"id":"ref-for-platform-authenticators\u2463"},{"id":"ref-for-platform-authenticators\u2464"},{"id":"ref-for-platform-authenticators\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2466"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-platform-authenticators\u2468"},{"id":"ref-for-platform-authenticators\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2460"},{"id":"ref-for-platform-authenticators\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2463"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2464"},{"id":"ref-for-platform-authenticators\u2460\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2466"},{"id":"ref-for-platform-authenticators\u2460\u2467"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2468"},{"id":"ref-for-platform-authenticators\u2461\u24ea"},{"id":"ref-for-platform-authenticators\u2461\u2460"},{"id":"ref-for-platform-authenticators\u2461\u2461"},{"id":"ref-for-platform-authenticators\u2461\u2462"},{"id":"ref-for-platform-authenticators\u2461\u2463"},{"id":"ref-for-platform-authenticators\u2461\u2464"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2467"},{"id":"ref-for-platform-authenticators\u2461\u2468"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u24ea"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2463"},{"id":"ref-for-platform-authenticators\u2462\u2464"}],"title":"14.5.3. Privacy Between Operating System Accounts"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2465"}],"title":"15. Accessibility Considerations"}],"url":"#platform-authenticators"},
+"platform-authenticators": {"dfnID":"platform-authenticators","dfnText":"platform authenticators","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-authenticators"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-platform-authenticators\u2460"},{"id":"ref-for-platform-authenticators\u2461"},{"id":"ref-for-platform-authenticators\u2462"},{"id":"ref-for-platform-authenticators\u2463"},{"id":"ref-for-platform-authenticators\u2464"},{"id":"ref-for-platform-authenticators\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2466"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-platform-authenticators\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-platform-authenticators\u2468"},{"id":"ref-for-platform-authenticators\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2462"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2463"},{"id":"ref-for-platform-authenticators\u2460\u2464"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2465"},{"id":"ref-for-platform-authenticators\u2460\u2466"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-authenticators\u2460\u2467"},{"id":"ref-for-platform-authenticators\u2460\u2468"},{"id":"ref-for-platform-authenticators\u2461\u24ea"},{"id":"ref-for-platform-authenticators\u2461\u2460"},{"id":"ref-for-platform-authenticators\u2461\u2461"},{"id":"ref-for-platform-authenticators\u2461\u2462"},{"id":"ref-for-platform-authenticators\u2461\u2463"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2464"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2465"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2466"},{"id":"ref-for-platform-authenticators\u2461\u2467"}],"title":"12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"},{"refs":[{"id":"ref-for-platform-authenticators\u2461\u2468"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2460"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2462"},{"id":"ref-for-platform-authenticators\u2462\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"},{"refs":[{"id":"ref-for-platform-authenticators\u2462\u2464"}],"title":"15. Accessibility Considerations"}],"url":"#platform-authenticators"},
 "platform-credential": {"dfnID":"platform-credential","dfnText":"platform credential","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-credential\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-credential\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-platform-credential\u2462"},{"id":"ref-for-platform-credential\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#platform-credential"},
 "prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-prf\u2461"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-prf\u2462"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
 "public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"},{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2466"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2467"},{"id":"ref-for-public-key-credential\u2462\u2468"},{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2462"},{"id":"ref-for-public-key-credential\u2463\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"},{"id":"ref-for-public-key-credential\u2463\u2467"},{"id":"ref-for-public-key-credential\u2463\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"},{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"},{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"},{"id":"ref-for-public-key-credential\u2465\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"},{"id":"ref-for-public-key-credential\u2466\u2463"},{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"},{"id":"ref-for-public-key-credential\u2467\u2462"},{"id":"ref-for-public-key-credential\u2467\u2463"},{"id":"ref-for-public-key-credential\u2467\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},