From 275fe5ee1a08a492188574ba026dd50cdd8faaf1 Mon Sep 17 00:00:00 2001
From: Adam Langley <agl@google.com>
Date: Wed, 13 Dec 2023 20:14:38 +0000
Subject: [PATCH] Merge pull request #2003 from
 w3c/issue-2002-non-resident-storage

SHA: 26da246372d211f454c11c40f668c3dc52fe896c
Reason: push, by agl

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 74 +++++++++++++++++++++++++++---------------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/index.html b/index.html
index df626bc80..b2d46ceb4 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 5dc73194b, updated Mon Dec 11 17:50:16 2023 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="db0b65998dde9cde0b7ddde13a80399fe22ff95f" name="revision">
+  <meta content="26da246372d211f454c11c40f668c3dc52fe896c" name="revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -5030,9 +5030,9 @@ <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modal
      <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can use it.</p>
    </ol>
    <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
@@ -5043,10 +5043,10 @@ <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modal
 credential capable</dfn>.</p>
     <li data-md>
      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
-modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private keys</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
+modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
    <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> MAY
-at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code>.</p>
+at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code>.</p>
    <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-capability"><span class="secno">6.2.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-factor-capability">Authentication Factor Capability</dfn></span><a class="self-link" href="#sctn-authentication-factor-capability"></a></h4>
    <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication
 ceremony</a>: <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a>, <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">something you know</a> and <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you are</a>. Examples include a physical key, a password,
@@ -5066,7 +5066,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
    <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a> <var>credSource</var>:</p>
+     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
        <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> to <var>credentialId</var>.</p>
@@ -5074,7 +5074,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
@@ -5182,7 +5182,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
       <li data-md>
        <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
       <li data-md>
-       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> with the fields:</p>
+       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
@@ -5292,7 +5292,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential sources</a>.</p>
     <li data-md>
      <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
@@ -5310,7 +5310,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
-     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
+     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
     Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> may be shown
     by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
@@ -5410,7 +5410,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
@@ -5461,7 +5461,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
 enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
-MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private key</a>,
+MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
 or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>.</p>
    <p>All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, and optionally when exercised, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①④">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
    <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
@@ -5477,7 +5477,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
 data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
-attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation
+attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation
 statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a>:</p>
    <ol>
     <li data-md>
@@ -5663,7 +5663,7 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-attestation-types"><span
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="self-attestation">Self Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="self">Self</dfn>)
     <dd data-md>
      <p>In the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①②">self attestation</a>, also known as surrogate basic attestation <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a>, the Authenticator does not have
-any specific <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑤">attestation key pair</a>. Instead it uses the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private key</a> to create the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑧">attestation signature</a>.
+any specific <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑤">attestation key pair</a>. Instead it uses the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private key</a> to create the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑧">attestation signature</a>.
 Authenticators without meaningful protection measures for an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key②">attestation private key</a> typically use this attestation type.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-ca">Attestation CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attca">AttCA</dfn>)
     <dd data-md>
@@ -5860,7 +5860,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
     then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
@@ -6031,7 +6031,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
         <dt>less than or equal to <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount③">signCount</a></code>:
         <dd>This is a signal that
           the authenticator may be cloned, i.e. at least
-          two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential private key</a> may exist and are
+          two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private key</a> may exist and are
           being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> should incorporate this information
           into their risk scoring.
           Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a>-specific. 
@@ -7032,7 +7032,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential source</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7631,7 +7631,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
      <p>For both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operations:</p>
      <ol>
       <li data-md>
-       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
+       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
       <li data-md>
        <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
       <li data-md>
@@ -7716,7 +7716,7 @@ <h5 class="heading settled" data-level="10.2.2.3" id="sctn-supplemental-public-k
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</dfn>
     <dd data-md>
-     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a>.</p>
+     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a>.</p>
      <p>A <dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-supplemental-public-key-record">supplemental public key record</dfn> is an abstract representation of a registered supplemental public key.
 It is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑥">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①④">items</a>:</p>
      <dl>
@@ -8170,7 +8170,7 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -8214,11 +8214,11 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <td>string
       <tr>
        <td><var>signCount</var>
-       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential source</a>.
+       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">public key credential source</a>.
        <td>number
       <tr>
        <td><var>largeBlob</var>
-       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a>.
+       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a>.
                     This property may not be defined. 
        <td>string
     </table>
@@ -8313,7 +8313,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
 stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④②">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
@@ -8335,13 +8335,13 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
     <li data-md>
      <p>Let <var>credentialsArray</var> be an empty array.</p>
     <li data-md>
-     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
+     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
 construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -8362,14 +8362,14 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
     <li data-md>
      <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
-     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
+     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
+     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -8388,7 +8388,7 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②①">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
@@ -8619,7 +8619,7 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
    <p><em>This section is not normative.</em></p>
    <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a>, if present,
 may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a>, on its own,
 provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑥">attestation object</a> was generated
 by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
@@ -8627,7 +8627,7 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
 The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑦">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
    <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
 same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> and passing through the same attacker.</p>
@@ -8648,8 +8648,8 @@ <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-cer
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
    <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
 lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
@@ -8750,7 +8750,7 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
    <ul>
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
 private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>.</p>
     <li data-md>
      <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
@@ -11442,7 +11442,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['conforming-user-agent'] = {"dfnID": "conforming-user-agent", "url": "#conforming-user-agent", "dfnText": "Conforming User Agent", "refSections": [{"refs": [{"id": "ref-for-conforming-user-agent"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2460"}], "title": "2.1. User Agents"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2461"}], "title": "2.2. Authenticators"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2463"}], "title": "6.4.1. String Truncation"}], "external": false};
 window.dfnpanelData['credential-id'] = {"dfnID": "credential-id", "url": "#credential-id", "dfnText": "Credential ID", "refSections": [{"refs": [{"id": "ref-for-credential-id"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-credential-id\u2460"}, {"id": "ref-for-credential-id\u2461"}, {"id": "ref-for-credential-id\u2462"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-credential-id\u2463"}, {"id": "ref-for-credential-id\u2464"}, {"id": "ref-for-credential-id\u2465"}, {"id": "ref-for-credential-id\u2466"}, {"id": "ref-for-credential-id\u2467"}, {"id": "ref-for-credential-id\u2468"}, {"id": "ref-for-credential-id\u2460\u24ea"}, {"id": "ref-for-credential-id\u2460\u2460"}, {"id": "ref-for-credential-id\u2460\u2461"}, {"id": "ref-for-credential-id\u2460\u2462"}, {"id": "ref-for-credential-id\u2460\u2463"}, {"id": "ref-for-credential-id\u2460\u2464"}, {"id": "ref-for-credential-id\u2460\u2465"}, {"id": "ref-for-credential-id\u2460\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-id\u2460\u2467"}, {"id": "ref-for-credential-id\u2460\u2468"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-id\u2461\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2463"}, {"id": "ref-for-credential-id\u2461\u2464"}, {"id": "ref-for-credential-id\u2461\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2466"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u24ea"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2460"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2461"}, {"id": "ref-for-credential-id\u2462\u2462"}, {"id": "ref-for-credential-id\u2462\u2463"}, {"id": "ref-for-credential-id\u2462\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2465"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2468"}, {"id": "ref-for-credential-id\u2463\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2461"}, {"id": "ref-for-credential-id\u2463\u2462"}, {"id": "ref-for-credential-id\u2463\u2463"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2465"}, {"id": "ref-for-credential-id\u2463\u2466"}, {"id": "ref-for-credential-id\u2463\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2468"}, {"id": "ref-for-credential-id\u2464\u24ea"}, {"id": "ref-for-credential-id\u2464\u2460"}, {"id": "ref-for-credential-id\u2464\u2461"}, {"id": "ref-for-credential-id\u2464\u2462"}, {"id": "ref-for-credential-id\u2464\u2463"}, {"id": "ref-for-credential-id\u2464\u2464"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
 window.dfnpanelData['credential-key-pair'] = {"dfnID": "credential-key-pair", "url": "#credential-key-pair", "dfnText": "Credential Key Pair", "refSections": [{"refs": [{"id": "ref-for-credential-key-pair"}, {"id": "ref-for-credential-key-pair\u2460"}, {"id": "ref-for-credential-key-pair\u2461"}, {"id": "ref-for-credential-key-pair\u2462"}, {"id": "ref-for-credential-key-pair\u2463"}, {"id": "ref-for-credential-key-pair\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-key-pair\u2465"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-credential-key-pair\u2466"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
-window.dfnpanelData['credential-private-key'] = {"dfnID": "credential-private-key", "url": "#credential-private-key", "dfnText": "Credential Private Key", "refSections": [{"refs": [{"id": "ref-for-credential-private-key"}, {"id": "ref-for-credential-private-key\u2460"}, {"id": "ref-for-credential-private-key\u2461"}, {"id": "ref-for-credential-private-key\u2462"}, {"id": "ref-for-credential-private-key\u2463"}, {"id": "ref-for-credential-private-key\u2464"}, {"id": "ref-for-credential-private-key\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-private-key\u2466"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-private-key\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-credential-private-key\u2468"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u24ea"}, {"id": "ref-for-credential-private-key\u2460\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2461"}, {"id": "ref-for-credential-private-key\u2460\u2462"}, {"id": "ref-for-credential-private-key\u2460\u2463"}, {"id": "ref-for-credential-private-key\u2460\u2464"}, {"id": "ref-for-credential-private-key\u2460\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2466"}, {"id": "ref-for-credential-private-key\u2460\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2468"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2461"}, {"id": "ref-for-credential-private-key\u2461\u2462"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2463"}, {"id": "ref-for-credential-private-key\u2461\u2464"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2465"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
+window.dfnpanelData['credential-private-key'] = {"dfnID": "credential-private-key", "url": "#credential-private-key", "dfnText": "Credential Private Key", "refSections": [{"refs": [{"id": "ref-for-credential-private-key"}, {"id": "ref-for-credential-private-key\u2460"}, {"id": "ref-for-credential-private-key\u2461"}, {"id": "ref-for-credential-private-key\u2462"}, {"id": "ref-for-credential-private-key\u2463"}, {"id": "ref-for-credential-private-key\u2464"}, {"id": "ref-for-credential-private-key\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-private-key\u2466"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-private-key\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-credential-private-key\u2468"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u24ea"}, {"id": "ref-for-credential-private-key\u2460\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2461"}, {"id": "ref-for-credential-private-key\u2460\u2462"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2463"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2466"}, {"id": "ref-for-credential-private-key\u2460\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2468"}, {"id": "ref-for-credential-private-key\u2461\u24ea"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2460"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
 window.dfnpanelData['credential-public-key'] = {"dfnID": "credential-public-key", "url": "#credential-public-key", "dfnText": "Credential Public Key", "refSections": [{"refs": [{"id": "ref-for-credential-public-key"}, {"id": "ref-for-credential-public-key\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-credential-public-key\u2461"}, {"id": "ref-for-credential-public-key\u2462"}, {"id": "ref-for-credential-public-key\u2463"}, {"id": "ref-for-credential-public-key\u2464"}, {"id": "ref-for-credential-public-key\u2465"}, {"id": "ref-for-credential-public-key\u2466"}, {"id": "ref-for-credential-public-key\u2467"}, {"id": "ref-for-credential-public-key\u2468"}, {"id": "ref-for-credential-public-key\u2460\u24ea"}, {"id": "ref-for-credential-public-key\u2460\u2460"}, {"id": "ref-for-credential-public-key\u2460\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-public-key\u2460\u2462"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-credential-public-key\u2460\u2463"}, {"id": "ref-for-credential-public-key\u2460\u2464"}, {"id": "ref-for-credential-public-key\u2460\u2465"}, {"id": "ref-for-credential-public-key\u2460\u2466"}, {"id": "ref-for-credential-public-key\u2460\u2467"}, {"id": "ref-for-credential-public-key\u2460\u2468"}, {"id": "ref-for-credential-public-key\u2461\u24ea"}, {"id": "ref-for-credential-public-key\u2461\u2460"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2461"}], "title": "5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2462"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2463"}, {"id": "ref-for-credential-public-key\u2461\u2464"}, {"id": "ref-for-credential-public-key\u2461\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2466"}, {"id": "ref-for-credential-public-key\u2461\u2467"}, {"id": "ref-for-credential-public-key\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u24ea"}, {"id": "ref-for-credential-public-key\u2462\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2461"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2462"}, {"id": "ref-for-credential-public-key\u2462\u2463"}], "title": "8.8. Apple Anonymous Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2464"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2465"}, {"id": "ref-for-credential-public-key\u2462\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2468"}, {"id": "ref-for-credential-public-key\u2463\u24ea"}, {"id": "ref-for-credential-public-key\u2463\u2460"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
 window.dfnpanelData['user-public-key'] = {"dfnID": "user-public-key", "url": "#user-public-key", "dfnText": "User Public Key", "refSections": [{"refs": [{"id": "ref-for-user-public-key"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-public-key\u2460"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
 window.dfnpanelData['user-credential'] = {"dfnID": "user-credential", "url": "#user-credential", "dfnText": "User Credential", "refSections": [{"refs": [{"id": "ref-for-user-credential"}, {"id": "ref-for-user-credential\u2460"}, {"id": "ref-for-user-credential\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-credential\u2462"}, {"id": "ref-for-user-credential\u2463"}, {"id": "ref-for-user-credential\u2464"}, {"id": "ref-for-user-credential\u2465"}, {"id": "ref-for-user-credential\u2466"}, {"id": "ref-for-user-credential\u2467"}, {"id": "ref-for-user-credential\u2468"}, {"id": "ref-for-user-credential\u2460\u24ea"}, {"id": "ref-for-user-credential\u2460\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2461"}, {"id": "ref-for-user-credential\u2460\u2462"}, {"id": "ref-for-user-credential\u2460\u2463"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2464"}, {"id": "ref-for-user-credential\u2460\u2465"}, {"id": "ref-for-user-credential\u2460\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2467"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-user-credential\u2461\u24ea"}, {"id": "ref-for-user-credential\u2461\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
@@ -11465,7 +11465,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['human-palatability'] = {"dfnID": "human-palatability", "url": "#human-palatability", "dfnText": "Human Palatability", "refSections": [{"refs": [{"id": "ref-for-human-palatability"}, {"id": "ref-for-human-palatability\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-human-palatability\u2461"}, {"id": "ref-for-human-palatability\u2462"}, {"id": "ref-for-human-palatability\u2463"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-human-palatability\u2464"}, {"id": "ref-for-human-palatability\u2465"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-human-palatability\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['non-discoverable-credential'] = {"dfnID": "non-discoverable-credential", "url": "#non-discoverable-credential", "dfnText": "Non-Discoverable Credential", "refSections": [{"refs": [{"id": "ref-for-non-discoverable-credential"}, {"id": "ref-for-non-discoverable-credential\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['public-key-credential'] = {"dfnID": "public-key-credential", "url": "#public-key-credential", "dfnText": "Public Key Credential", "refSections": [{"refs": [{"id": "ref-for-public-key-credential\u2461"}, {"id": "ref-for-public-key-credential\u2462"}, {"id": "ref-for-public-key-credential\u2463"}, {"id": "ref-for-public-key-credential\u2464"}, {"id": "ref-for-public-key-credential\u2465"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-public-key-credential\u2466"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-public-key-credential\u2467"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-public-key-credential\u2468"}, {"id": "ref-for-public-key-credential\u2460\u24ea"}, {"id": "ref-for-public-key-credential\u2460\u2460"}, {"id": "ref-for-public-key-credential\u2460\u2461"}, {"id": "ref-for-public-key-credential\u2460\u2462"}, {"id": "ref-for-public-key-credential\u2460\u2463"}, {"id": "ref-for-public-key-credential\u2460\u2464"}, {"id": "ref-for-public-key-credential\u2460\u2465"}, {"id": "ref-for-public-key-credential\u2460\u2466"}, {"id": "ref-for-public-key-credential\u2460\u2467"}, {"id": "ref-for-public-key-credential\u2460\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u24ea"}, {"id": "ref-for-public-key-credential\u2461\u2460"}, {"id": "ref-for-public-key-credential\u2461\u2461"}, {"id": "ref-for-public-key-credential\u2461\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2464"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2465"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2466"}, {"id": "ref-for-public-key-credential\u2461\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2468"}, {"id": "ref-for-public-key-credential\u2462\u24ea"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2460"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2462"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2463"}], "title": "5.8. Supporting Data Structures"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2464"}, {"id": "ref-for-public-key-credential\u2462\u2465"}, {"id": "ref-for-public-key-credential\u2462\u2466"}, {"id": "ref-for-public-key-credential\u2462\u2467"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u24ea"}, {"id": "ref-for-public-key-credential\u2463\u2460"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2461"}, {"id": "ref-for-public-key-credential\u2463\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2463"}, {"id": "ref-for-public-key-credential\u2463\u2464"}, {"id": "ref-for-public-key-credential\u2463\u2465"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2468"}, {"id": "ref-for-public-key-credential\u2464\u24ea"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2460"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2465"}, {"id": "ref-for-public-key-credential\u2464\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2468"}, {"id": "ref-for-public-key-credential\u2465\u24ea"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2460"}, {"id": "ref-for-public-key-credential\u2465\u2461"}, {"id": "ref-for-public-key-credential\u2465\u2462"}, {"id": "ref-for-public-key-credential\u2465\u2463"}, {"id": "ref-for-public-key-credential\u2465\u2464"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2465"}, {"id": "ref-for-public-key-credential\u2465\u2466"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2467"}, {"id": "ref-for-public-key-credential\u2465\u2468"}, {"id": "ref-for-public-key-credential\u2466\u24ea"}, {"id": "ref-for-public-key-credential\u2466\u2460"}, {"id": "ref-for-public-key-credential\u2466\u2461"}, {"id": "ref-for-public-key-credential\u2466\u2462"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2463"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2464"}, {"id": "ref-for-public-key-credential\u2466\u2465"}, {"id": "ref-for-public-key-credential\u2466\u2466"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2467"}, {"id": "ref-for-public-key-credential\u2466\u2468"}, {"id": "ref-for-public-key-credential\u2467\u24ea"}, {"id": "ref-for-public-key-credential\u2467\u2460"}, {"id": "ref-for-public-key-credential\u2467\u2461"}], "title": "14.5.2. Authentication Ceremony Privacy"}], "external": false};
-window.dfnpanelData['public-key-credential-source'] = {"dfnID": "public-key-credential-source", "url": "#public-key-credential-source", "dfnText": "Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source"}, {"id": "ref-for-public-key-credential-source\u2460"}, {"id": "ref-for-public-key-credential-source\u2461"}, {"id": "ref-for-public-key-credential-source\u2462"}, {"id": "ref-for-public-key-credential-source\u2463"}, {"id": "ref-for-public-key-credential-source\u2464"}, {"id": "ref-for-public-key-credential-source\u2465"}, {"id": "ref-for-public-key-credential-source\u2466"}, {"id": "ref-for-public-key-credential-source\u2467"}, {"id": "ref-for-public-key-credential-source\u2468"}, {"id": "ref-for-public-key-credential-source\u2460\u24ea"}, {"id": "ref-for-public-key-credential-source\u2460\u2460"}, {"id": "ref-for-public-key-credential-source\u2460\u2461"}, {"id": "ref-for-public-key-credential-source\u2460\u2462"}, {"id": "ref-for-public-key-credential-source\u2460\u2463"}, {"id": "ref-for-public-key-credential-source\u2460\u2464"}, {"id": "ref-for-public-key-credential-source\u2460\u2465"}, {"id": "ref-for-public-key-credential-source\u2460\u2466"}, {"id": "ref-for-public-key-credential-source\u2460\u2467"}, {"id": "ref-for-public-key-credential-source\u2460\u2468"}, {"id": "ref-for-public-key-credential-source\u2461\u24ea"}, {"id": "ref-for-public-key-credential-source\u2461\u2460"}, {"id": "ref-for-public-key-credential-source\u2461\u2461"}, {"id": "ref-for-public-key-credential-source\u2461\u2462"}, {"id": "ref-for-public-key-credential-source\u2461\u2463"}, {"id": "ref-for-public-key-credential-source\u2461\u2464"}, {"id": "ref-for-public-key-credential-source\u2461\u2465"}, {"id": "ref-for-public-key-credential-source\u2461\u2466"}, {"id": "ref-for-public-key-credential-source\u2461\u2467"}, {"id": "ref-for-public-key-credential-source\u2461\u2468"}, {"id": "ref-for-public-key-credential-source\u2462\u24ea"}, {"id": "ref-for-public-key-credential-source\u2462\u2460"}, {"id": "ref-for-public-key-credential-source\u2462\u2461"}, {"id": "ref-for-public-key-credential-source\u2462\u2462"}, {"id": "ref-for-public-key-credential-source\u2462\u2463"}, {"id": "ref-for-public-key-credential-source\u2462\u2464"}, {"id": "ref-for-public-key-credential-source\u2462\u2465"}, {"id": "ref-for-public-key-credential-source\u2462\u2466"}, {"id": "ref-for-public-key-credential-source\u2462\u2467"}, {"id": "ref-for-public-key-credential-source\u2462\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u24ea"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2460"}, {"id": "ref-for-public-key-credential-source\u2463\u2461"}, {"id": "ref-for-public-key-credential-source\u2463\u2462"}, {"id": "ref-for-public-key-credential-source\u2463\u2463"}, {"id": "ref-for-public-key-credential-source\u2463\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2466"}, {"id": "ref-for-public-key-credential-source\u2463\u2467"}, {"id": "ref-for-public-key-credential-source\u2463\u2468"}, {"id": "ref-for-public-key-credential-source\u2464\u24ea"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2460"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2461"}, {"id": "ref-for-public-key-credential-source\u2464\u2462"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2463"}, {"id": "ref-for-public-key-credential-source\u2464\u2464"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2466"}, {"id": "ref-for-public-key-credential-source\u2464\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2468"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2461"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2462"}, {"id": "ref-for-public-key-credential-source\u2465\u2463"}, {"id": "ref-for-public-key-credential-source\u2465\u2464"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2465"}, {"id": "ref-for-public-key-credential-source\u2465\u2466"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2467"}, {"id": "ref-for-public-key-credential-source\u2465\u2468"}, {"id": "ref-for-public-key-credential-source\u2466\u24ea"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u2460"}, {"id": "ref-for-public-key-credential-source\u2466\u2461"}], "title": "11.8. Remove All Credentials"}], "external": false};
+window.dfnpanelData['public-key-credential-source'] = {"dfnID": "public-key-credential-source", "url": "#public-key-credential-source", "dfnText": "Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source"}, {"id": "ref-for-public-key-credential-source\u2460"}, {"id": "ref-for-public-key-credential-source\u2461"}, {"id": "ref-for-public-key-credential-source\u2462"}, {"id": "ref-for-public-key-credential-source\u2463"}, {"id": "ref-for-public-key-credential-source\u2464"}, {"id": "ref-for-public-key-credential-source\u2465"}, {"id": "ref-for-public-key-credential-source\u2466"}, {"id": "ref-for-public-key-credential-source\u2467"}, {"id": "ref-for-public-key-credential-source\u2468"}, {"id": "ref-for-public-key-credential-source\u2460\u24ea"}, {"id": "ref-for-public-key-credential-source\u2460\u2460"}, {"id": "ref-for-public-key-credential-source\u2460\u2461"}, {"id": "ref-for-public-key-credential-source\u2460\u2462"}, {"id": "ref-for-public-key-credential-source\u2460\u2463"}, {"id": "ref-for-public-key-credential-source\u2460\u2464"}, {"id": "ref-for-public-key-credential-source\u2460\u2465"}, {"id": "ref-for-public-key-credential-source\u2460\u2466"}, {"id": "ref-for-public-key-credential-source\u2460\u2467"}, {"id": "ref-for-public-key-credential-source\u2460\u2468"}, {"id": "ref-for-public-key-credential-source\u2461\u24ea"}, {"id": "ref-for-public-key-credential-source\u2461\u2460"}, {"id": "ref-for-public-key-credential-source\u2461\u2461"}, {"id": "ref-for-public-key-credential-source\u2461\u2462"}, {"id": "ref-for-public-key-credential-source\u2461\u2463"}, {"id": "ref-for-public-key-credential-source\u2461\u2464"}, {"id": "ref-for-public-key-credential-source\u2461\u2465"}, {"id": "ref-for-public-key-credential-source\u2461\u2466"}, {"id": "ref-for-public-key-credential-source\u2461\u2467"}, {"id": "ref-for-public-key-credential-source\u2461\u2468"}, {"id": "ref-for-public-key-credential-source\u2462\u24ea"}, {"id": "ref-for-public-key-credential-source\u2462\u2460"}, {"id": "ref-for-public-key-credential-source\u2462\u2461"}, {"id": "ref-for-public-key-credential-source\u2462\u2462"}, {"id": "ref-for-public-key-credential-source\u2462\u2463"}, {"id": "ref-for-public-key-credential-source\u2462\u2464"}, {"id": "ref-for-public-key-credential-source\u2462\u2465"}, {"id": "ref-for-public-key-credential-source\u2462\u2466"}, {"id": "ref-for-public-key-credential-source\u2462\u2467"}, {"id": "ref-for-public-key-credential-source\u2462\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u24ea"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2460"}, {"id": "ref-for-public-key-credential-source\u2463\u2461"}, {"id": "ref-for-public-key-credential-source\u2463\u2462"}, {"id": "ref-for-public-key-credential-source\u2463\u2463"}, {"id": "ref-for-public-key-credential-source\u2463\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2466"}, {"id": "ref-for-public-key-credential-source\u2463\u2467"}, {"id": "ref-for-public-key-credential-source\u2463\u2468"}, {"id": "ref-for-public-key-credential-source\u2464\u24ea"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2460"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2461"}, {"id": "ref-for-public-key-credential-source\u2464\u2462"}, {"id": "ref-for-public-key-credential-source\u2464\u2463"}, {"id": "ref-for-public-key-credential-source\u2464\u2464"}, {"id": "ref-for-public-key-credential-source\u2464\u2465"}, {"id": "ref-for-public-key-credential-source\u2464\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2467"}, {"id": "ref-for-public-key-credential-source\u2464\u2468"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2460"}, {"id": "ref-for-public-key-credential-source\u2465\u2461"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2465"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2466"}, {"id": "ref-for-public-key-credential-source\u2465\u2467"}, {"id": "ref-for-public-key-credential-source\u2465\u2468"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u24ea"}, {"id": "ref-for-public-key-credential-source\u2466\u2460"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u2461"}, {"id": "ref-for-public-key-credential-source\u2466\u2462"}, {"id": "ref-for-public-key-credential-source\u2466\u2463"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u2464"}, {"id": "ref-for-public-key-credential-source\u2466\u2465"}], "title": "11.8. Remove All Credentials"}], "external": false};
 window.dfnpanelData['public-key-credential-source-type'] = {"dfnID": "public-key-credential-source-type", "url": "#public-key-credential-source-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2460"}, {"id": "ref-for-public-key-credential-source-type\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2463"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['public-key-credential-source-id'] = {"dfnID": "public-key-credential-source-id", "url": "#public-key-credential-source-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-id"}, {"id": "ref-for-public-key-credential-source-id\u2460"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2465"}, {"id": "ref-for-public-key-credential-source-id\u2466"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['public-key-credential-source-privatekey'] = {"dfnID": "public-key-credential-source-privatekey", "url": "#public-key-credential-source-privatekey", "dfnText": "privateKey", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-privatekey"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-privatekey\u2460"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-privatekey\u2461"}, {"id": "ref-for-public-key-credential-source-privatekey\u2462"}], "title": "11.5. Add Credential"}], "external": false};