From 68f2859dd3f6050ab8d5f62e8d8b21e7df62b704 Mon Sep 17 00:00:00 2001
From: Nick Steele <344821+nicksteele@users.noreply.github.com>
Date: Wed, 3 Apr 2024 19:53:32 +0000
Subject: [PATCH] Merge pull request #2031 from
 w3c/issue-2016-credentialRecord-transports

SHA: 3ad0eda0ebc4f54b522518f71461449657c4c43b
Reason: push, by nicksteele

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 661 ++++++++++++++++++++++++++---------------------------
 1 file changed, 330 insertions(+), 331 deletions(-)

diff --git a/index.html b/index.html
index f8388bb22..6f71f1b6b 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version d765c696b, updated Fri Mar 8 15:58:52 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="064041d51c8e84207763903df5c3fe4e3581cb0c" name="revision">
+  <meta content="3ad0eda0ebc4f54b522518f71461449657c4c43b" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -4444,29 +4444,28 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
 </pre>
    <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
 It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a>.
-It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a>.</p>
+   <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a>,
+and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑤">DOMString</a></span>
      <dd data-md>
       <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.
+This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> is semantically distinct.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
       <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code>.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
+This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥">DOMString</a>></span>
      <dd data-md>
       <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values.</p>
-      <p>This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
-of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> operation.
-When <a href="#sctn-registering-a-new-credential">registering a new credential</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
-When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> for that credential,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> SHOULD retrieve that stored value
-and set it as the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> member.</p>
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
+This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
+of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> operation.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="secno">5.8.4. </span><span class="content">Authenticator Transport Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatortransport"><code>AuthenticatorTransport</code></dfn>)</span><a class="self-link" href="#enum-transport"></a></h4>
@@ -4483,7 +4482,7 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
    <div>
      <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
@@ -4542,16 +4541,16 @@ <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirem
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -4594,20 +4593,20 @@ <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secn
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints③">PublicKeyCredentialHints</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
-    <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①③">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
+     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
+    <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhints-security-key"><code>security-key</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhints-client-device"><code>client-device</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhints-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -4621,7 +4620,7 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
    <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
 To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span class="secno">6. </span><span class="content">WebAuthn <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-model">Authenticator Model</dfn></span><a class="self-link" href="#sctn-authenticator-model"></a></h2>
    <p><a href="#sctn-api">The Web Authentication API</a> implies a specific abstract functional model for a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticator</a>. This section
 describes that <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model②">authenticator model</a>.</p>
@@ -4631,12 +4630,12 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
 the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a>. For instance, this abstract model does not define protocols for
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -4644,17 +4643,17 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 operates at a higher security level than the rest of the authenticator. This is particularly important for authenticators that
 are embedded in the WebAuthn client, as in those cases this cryptographic module (which may, for example, be a TPM) could be
 considered more trustworthy than the rest of the authenticator.</p>
-   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.</p>
+   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a>.</p>
    <p>Additionally, each authenticator has an Authenticator Attestation Globally Unique Identifier or <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="aaguid">AAGUID</dfn>, which is a 128-bit identifier
 indicating the type (e.g. make and model) of the authenticator. The AAGUID MUST be chosen by its maker to be identical across all substantially identical
 authenticators made by that maker, and different (with high probability) from the AAGUIDs of all other types of authenticators. The AAGUID for a given type
-of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
-certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
+of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
+certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
 the authenticator without requesting and verifying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a>, but the AAGUID is not provably authentic without <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a>.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
 referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
 sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>.</p>
@@ -4693,7 +4692,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
 controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
 limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a>.</p>
@@ -4738,17 +4737,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
           <p>Bit 3: <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility①">Backup Eligibility</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-be">BE</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 4: <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state①">Backup State</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-bs">BS</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 5: Reserved for future use (<code>RFU2</code>).</p>
@@ -4819,15 +4818,15 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -4843,7 +4842,7 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
    <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
    <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
@@ -4871,25 +4870,25 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
     </table>
     <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
    <ul>
     <li data-md>
      <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticators</a>:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registered</a> and/or an account recovery process in place.
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registered</a> and/or an account recovery process in place.
 For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
 to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a>,
 such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
@@ -4974,7 +4973,7 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a>.</p>
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a>.</p>
    <p>The combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
@@ -5017,15 +5016,15 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
 backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
      <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> can use it.</p>
    </ol>
    <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
@@ -5036,7 +5035,7 @@ <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modal
 credential capable</dfn>.</p>
     <li data-md>
      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
-modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
+modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
    <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> MAY
 at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code>.</p>
@@ -5048,8 +5047,8 @@ <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-ca
 verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> can
 verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> that is
 not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①②">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
@@ -5059,7 +5058,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
    <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a> <var>credSource</var>:</p>
+     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
        <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> to <var>credentialId</var>.</p>
@@ -5067,7 +5066,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
@@ -5083,10 +5082,10 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a>.</p>
@@ -5100,11 +5099,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -5112,11 +5111,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
@@ -5147,7 +5146,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑧">authorization gesture</a> is not to proceed with creating a credential,
 but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>.
 If the user does not consent,
 the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
@@ -5175,7 +5174,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
       <li data-md>
        <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
       <li data-md>
-       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a> with the fields:</p>
+       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
@@ -5257,7 +5256,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -5270,7 +5269,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
    <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> MUST perform the following procedure:</p>
@@ -5279,7 +5278,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential sources</a>.</p>
     <li data-md>
      <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
@@ -5297,7 +5296,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
-     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
+     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
     Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> may be shown
     by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
@@ -5346,7 +5345,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5384,7 +5383,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
@@ -5399,7 +5398,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
      <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
    <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
    <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
@@ -5407,7 +5406,7 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
      <img src="images/string-truncation.svg"> 
     <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
    </figure>
-   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
+   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
    <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
    <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticators</a>, user agents SHOULD:</p>
    <ol>
@@ -5434,12 +5433,12 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> can
 produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
-enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
+enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
 or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
    <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
-for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a>.</p>
+for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> to base a trust decision on.
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
     <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
@@ -5451,7 +5450,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
 attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
@@ -5459,7 +5458,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format④">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, after verifying that it
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑤">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
@@ -5476,9 +5475,9 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
      <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
    <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
-formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Parties</a> will also need to
+formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> will also need to
 understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data"><span class="secno">6.5.1. </span><span class="content">Attested Credential Data</span><a class="self-link" href="#sctn-attested-credential-data"></a></h4>
    <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
@@ -5610,12 +5609,12 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span class="secno">6.5.3. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
    <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
 calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
-section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
+section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 24</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
 Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is acceptable
-under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> policy.</p>
+under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
     <dd data-md>
@@ -5633,12 +5632,12 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span
 "endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
 for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
@@ -5713,17 +5712,17 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 The signature is not ASN.1 wrapped.</p>
    </ul>
    <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a>'s script receives
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a>'s script receives
 a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
-respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> server, using methods outside
-the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> must perform upon receipt of these
+respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> server, using methods outside
+the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
@@ -5751,17 +5750,17 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
-    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>.
+    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> expects that this credential would have been created within an iframe that is
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li data-md>
@@ -5769,29 +5768,29 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑤">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a>.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
     <li id="reg-ceremony-verify-extension-outputs">
      <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys①">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-create">§ 10.2.2.3.1 Registration (create())</a>.</p>
     <li data-md>
@@ -5811,9 +5810,9 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 22</a>, as follows: 
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate
 (i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">step 23</a> may be the same).</p>
@@ -5821,20 +5820,20 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
-    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
+    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
     with the following contents: 
      <dl>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type②">type</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type②">type</a></code></code>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
-whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a>.</p>
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-publickey" id="ref-for-abstract-opdef-credential-record-publickey">publicKey</a>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
@@ -5844,9 +5843,9 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized②">uvInitialized</a>
       <dd data-md>
        <p>The value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flag</a> in <var>authData</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports②">transports</a>
       <dd data-md>
-       <p>The value returned from <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑦">getTransports()</a></code></code>.</p>
+       <p>The value returned from <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code></code>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible">backupEligible</a>
       <dd data-md>
        <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flag</a> in <var>authData</var>.</p>
@@ -5854,7 +5853,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dd data-md>
        <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flag</a> in <var>authData</var>.</p>
      </dl>
-     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> MAY also include the following OPTIONAL contents:</p>
+     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> MAY also include the following OPTIONAL contents:</p>
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject①">attestationObject</a>
       <dd data-md>
@@ -5865,22 +5864,22 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      </dl>
     <li data-md>
      <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 24</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> is asserting there
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
+    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> is asserting there
     is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> has a trusted method of determining acceptable trust anchors
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> has a trusted method of determining acceptable trust anchors
 in <a href="#reg-ceremony-attestation-trust-anchors">step 23</a> above.
-Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
@@ -5896,19 +5895,19 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①③">is not empty</a>,
 verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code></code>.</p>
     <li data-md>
-     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>:</p>
+     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>:</p>
      <dl class="switch">
       <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a> was initiated, e.g., via a username or cookie,
       <dd data-md>
-       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a>.
+       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a>.
 If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
 verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a>.</p>
       <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremony</a> was initiated,
       <dd data-md>
        <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is present.
-Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a>.</p>
+Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id④">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑦">credential record</a>.</p>
      </dl>
     <li data-md>
      <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①⓪">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata②">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
@@ -5926,20 +5925,20 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a>.
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a>. 
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.</p>
@@ -5951,7 +5950,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> business logic or policy,
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> business logic or policy,
 let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> bits, respectively,
 of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var>.
 Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code>:</p>
@@ -5961,18 +5960,18 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible③">backupEligible</a></code> is not set, verify that <var>currentBe</var> is not set.</p>
       <li data-md>
-       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> policy, if any.</p>
+       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> policy, if any.</p>
      </ol>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
     <li id="authn-ceremony-verify-extension-outputs">
      <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys②">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-get">§ 10.2.2.3.2 Authentication (get())</a>.</p>
     <li data-md>
@@ -5994,9 +5993,9 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
         <dd>This is a signal that
           the authenticator may be cloned, i.e. at least
           two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private key</a> may exist and are
-          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Parties</a> should incorporate this information
+          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Parties</a> should incorporate this information
           into their risk scoring.
-          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a>-specific. 
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a>-specific. 
        </dl>
      </ul>
     <li id="authn-ceremony-update-credential-record">
@@ -6012,7 +6011,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
 This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">user verification</a>;
 if not authorized, skip this step.</p>
      </ol>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a> steps,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a> steps,
     the above state updates SHOULD be deferred to after those additional checks are completed successfully.</p>
     <li data-md>
      <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>.</p>
@@ -6159,8 +6158,8 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
     <li data-md>
      <p>If the related attestation root certificate is used for multiple authenticator models, the Extension OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) MUST be present, containing the AAGUID as a 16-byte OCTET STRING.
 The extension MUST NOT be marked as critical.</p>
-     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> may not know if the attestation root
-certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Parties</a> check if the extension
+     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Parties</a> may not know if the attestation root
+certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Parties</a> check if the extension
 is present, and if it is, then validate that it contains that same AAGUID as presented in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑦">attestation object</a>.</p>
      <p>Note that an X.509 Extension encodes the DER-encoding of the value in an OCTET STRING.
 Thus, the AAGUID MUST be wrapped in <i>two</i> OCTET STRINGS to be valid.</p>
@@ -6661,9 +6660,9 @@ <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><spa
      <ol>
       <li data-md>
        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①③">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
-       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> policy.</p>
+       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
+       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
 return implementation-specific values representing any combination of outputs from successful <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedures</a>.</p>
      </ol>
    </dl>
@@ -6682,7 +6681,7 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
    <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code> call
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code> call
 (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
@@ -6702,9 +6701,9 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
    <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
@@ -6737,7 +6736,7 @@ <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
    <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> know that the extension was honored by the authenticator. If an
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
@@ -6747,7 +6746,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -6766,8 +6765,8 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 <c- p>});</c->
 </pre>
    <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a>.</p>
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
 authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension
 input</a>,
@@ -6804,7 +6803,7 @@ <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-pr
 as a separate map, keyed with the same <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②①">extension identifier</a>. This map only contains entries for authenticator
 extensions that make use of unsigned outputs. Unsigned outputs are useful when extensions output a signature over
 the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a> (because otherwise a signature would have to sign over itself, which isn’t possible) or when
-some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a>.</p>
+some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs④">unsigned extension outputs</a> are returned as a CBOR map in a top-level field named <code>unsignedExtensionOutputs</code> from both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑨">authenticatorGetAssertion</a>.</p>
    <p>For each supported extension, the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing④">authenticator extension processing</a> rule for that extension is used create the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a>, and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑤">unsigned extension output</a> if used, from the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑦">authenticator extension input</a> and possibly also other inputs.
 There MUST NOT be any values returned for ignored extensions.</p>
@@ -6817,11 +6816,11 @@ <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
    <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
 order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> option
@@ -6844,8 +6843,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
 but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
    <dl>
@@ -6892,7 +6891,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code></dfn>;
 };
@@ -6909,7 +6908,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
    <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6948,7 +6947,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just prior to <a href="#CreateCred-InvokeAuthnrMakeCred">invoking authenticatorMakeCredential</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⑤">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
+         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
          <ol>
           <li data-md>
            <p>Check whether <var>C</var> was created using U2F on <var>authenticator</var> by sending a <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> whose "five parts" are set to the following values:</p>
@@ -6984,7 +6983,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
 };
@@ -7000,7 +6999,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential source</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7010,7 +7009,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code></dfn>;
 };
@@ -7048,7 +7047,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a></span>
        <dd data-md>
         <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
@@ -7056,17 +7055,17 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
         <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> MUST allow the user to choose this value.
 That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication</a> ceremony or MAY be made available outside
 the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> MAY reuse the same value
-for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a>.</p>
+for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Parties</a>.</p>
         <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>, by some unspecified mechanism, for this
 value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> MAY allow the user to configure the response to such a
 query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> vendor MAY provide a default response to such a query.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> MAY consider a user-configured response chosen by the user,
 and SHOULD allow the user to modify a vendor-provided default response.</p>
-        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential records</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output,
-if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a>.</p>
-        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑤">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑦">credential record</a>.</p>
+        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output,
+if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a>.</p>
+        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑤">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②①">credential record</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -7080,11 +7079,11 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
    <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
    <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> is identical.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7170,7 +7169,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
@@ -7194,9 +7193,9 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs">large, per-credential blobs</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
@@ -7233,10 +7232,10 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -7336,7 +7335,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
@@ -7351,7 +7350,7 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">Authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②⓪"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code></dfn>;
 };
@@ -7431,13 +7430,13 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
 </pre>
    </dl>
    <h4 class="heading settled" data-level="10.2.2" id="sctn-supplemental-public-keys-extension"><span class="secno">10.2.2. </span><span class="content">Supplemental public keys extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplementalpubkeys">supplementalPubKeys</dfn>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">navigator.credentials.get()</a></code> call.</p>
+   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">navigator.credentials.get()</a></code> call.</p>
    <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> is incapable of generating a supplemental key pair, or the registration or authentication operation fails for any reason, that key pair is omitted from the output. If no supplemental key pairs remain then this extension is ignored. In this case, there is no <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys④">supplementalPubKeys</a> extension output generated.</p>
    <p>Supplemental keys are not <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credentials</a> and they do not have their own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential IDs</a>. Instead, any returned keys are a contextual attribute of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is used—along with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑤">supplementalPubKeys</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, a particular set of supplemental keys are returned by the extension, along with signatures demonstrating proof-of-possession of those keys.</p>
    <p>Supplemental keys never have a scope that is larger than the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑧">user credential</a>. That is, they are never shared between any two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credentials</a> and can never be used to link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⓪">user credentials</a> together. They only communicate continuity of some property of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①①">user credential</a>.</p>
    <h5 class="heading settled" data-level="10.2.2.1" id="sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a> including further signatures by “SPK1”.</p>
+   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
+   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a> including further signatures by “SPK1”.</p>
    <p>The credential may move beyond the scope of that supplemental key (for example, by being exported and imported elsewhere, if <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a>) and, if used in this new domain, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">get()</a></code> operation will return a <i>new</i> supplemental key, SPK2, and its signature. Subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations may observe either SPK1 or SPK2, depending on the context in which the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a> is being used.</p>
    <p>A usage example is thus:</p>
    <blockquote>
@@ -7447,7 +7446,7 @@ <h5 class="heading settled" data-level="10.2.2.1" id="sctn-supplemental-public-k
    <blockquote>
     <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a> on its own. But if a signature from a supplemental key that is device-bound, and that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
    </blockquote>
-   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Parties</a> give to the presence of a signature from a supplemental key may be based on information learned from its optional attestation. An attestation can indicate the level of protection enjoyed by a hardware-bound key, or the policies for other types of supplemental key.</p>
+   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a> give to the presence of a signature from a supplemental key may be based on information learned from its optional attestation. An attestation can indicate the level of protection enjoyed by a hardware-bound key, or the policies for other types of supplemental key.</p>
    <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-keys-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-definition"></a></h5>
    <dl>
     <dt data-md>Extension identifier
@@ -7472,15 +7471,15 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-scopes"><code>scopes</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②">DOMString</a>></span>
        <dd data-md>
-        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
+        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦③">DOMString</a>, defaulting to <code>"indirect"</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
         <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect②">indirect</a></code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④">DOMString</a>>, defaulting to <code>[]</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
@@ -7599,7 +7598,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
      <p>For both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operations:</p>
      <ol>
       <li data-md>
-       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
+       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
       <li data-md>
        <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
       <li data-md>
@@ -7622,7 +7621,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
            <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑨">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator’s</a> AAGUID. (Since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①">supplemental public key</a>'s scope is different from the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑥">user credential</a>, it will often have a different attestation. For example, the attestation for a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key②">supplemental public key</a> with “device” scope can be tied to hardware roots of trust, although it does not have to be.)</p>
           <dt data-md>enterprise
           <dd data-md>
-           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⓪">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator’s</a> AAGUID.</p>
+           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⓪">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator’s</a> AAGUID.</p>
            <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticators</a>.</p>
          </dl>
         <li data-md>
@@ -7654,7 +7653,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
          <p>Append <var>supplementalPubKey</var> to <var>spks</var>.</p>
         <li data-md>
          <p>Let <var>spkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a> with <var>supplementalPrivateKey</var>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>spkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> knows that <var>spkSig</var> is a fresh signature.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>spkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> knows that <var>spkSig</var> is a fresh signature.</p>
         <li data-md>
          <p>Append <var>spkSig</var> to <var>spkSigs</var>.</p>
        </ol>
@@ -7666,9 +7665,9 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-k
      </ol>
    </dl>
    <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-supplemental-public-keys-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-aaguid"></a></h6>
-   <p>Any non-zero <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑤">AAGUID</a>s included in the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑥">supplementalPubKeys</a></code> extension output aid a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> in validating the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> of the supplemental public key. The interpretation of each AAGUID depends on the scope of the corresponding key. Some or all may differ from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①④">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑨">multi-device credential</a>. Thus the AAGUID of a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key④">supplemental public key</a> MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
+   <p>Any non-zero <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑤">AAGUID</a>s included in the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑥">supplementalPubKeys</a></code> extension output aid a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> in validating the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> of the supplemental public key. The interpretation of each AAGUID depends on the scope of the corresponding key. Some or all may differ from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①④">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑨">multi-device credential</a>. Thus the AAGUID of a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key④">supplemental public key</a> MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
    <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-supplemental-public-keys-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-calculations"></a></h6>
-   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a supplemental public key, the typical value for <code>authData</code> contains the attestation signature itself, which is impossible. Also the attestation of a supplemental public key is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
+   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a supplemental public key, the typical value for <code>authData</code> contains the attestation signature itself, which is impossible. Also the attestation of a supplemental public key is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
    <p>Therefore when calculating an attestation for a supplemental public key, the inputs are:</p>
    <ul>
     <li data-md>
@@ -7679,19 +7678,19 @@ <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-supplemental-public
    <p>The attestation signature is thus typically calculated over the bytes of <code>(h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e00ffffffff' || <var>aaguid</var> || <var>spk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a supplemental public key can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑧">user credential</a>.</p>
    <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>spkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the supplemental private key.</p>
    <h5 class="heading settled" data-level="10.2.2.3" id="sctn-supplemental-public-keys-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>supplementalPubKeys</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification"></a></h5>
-   <p>Verifying the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑦">supplementalPubKeys</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> whenever a supplemental public key is returned within the extension output.</p>
-   <p>The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑧">supplementalPubKeys</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①③">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>:</p>
+   <p>Verifying the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑦">supplementalPubKeys</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> whenever a supplemental public key is returned within the extension output.</p>
+   <p>The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑧">supplementalPubKeys</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①③">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②②">credential records</a>:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</dfn>
     <dd data-md>
-     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a>.</p>
+     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">public key credential source</a>.</p>
      <p>A <dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-supplemental-public-key-record">supplemental public key record</dfn> is an abstract representation of a registered supplemental public key.
 It is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑥">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①④">items</a>:</p>
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-aaguid">aaguid</dfn>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑥">AAGUID</a> included with the supplemental public key.
-This MAY be different from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a> in the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject②">attestationObject</a>, if any, of the containing <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a>.</p>
+This MAY be different from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a> in the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject②">attestationObject</a>, if any, of the containing <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②③">credential record</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-spk">spk</dfn>
       <dd data-md>
        <p>The public key portion of the supplemental public key.</p>
@@ -7707,8 +7706,8 @@ <h5 class="heading settled" data-level="10.2.2.3" id="sctn-supplemental-public-k
      </dl>
    </dl>
    <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> call,
-then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 20</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> call,
+then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 20</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Verify that the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys">supplementalPubKeys</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures" id="ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures">signatures</a></code> field. Let <var>signatures</var> be the value of that field.</p>
@@ -7725,7 +7724,7 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-supplemental-public
       <li data-md>
        <p>Verify that <var>signature</var> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①③">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑤">supplemental public key</a> <var>spk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑨">user credential</a>.)</p>
       <li data-md>
-       <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑦">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②③">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+       <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑦">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②③">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
       <li data-md>
        <p>Create a new <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record①">supplemental public key record</a> with the contents:</p>
@@ -7747,13 +7746,13 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-supplemental-public
          <p>The value of <var>attStmt</var>.</p>
        </dl>
        <p>In <a href="#reg-ceremony-store-credential-record">step 27</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-add this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record②">supplemental public key record</a> to the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</a> member of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>.</p>
+add this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record②">supplemental public key record</a> to the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</a> member of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②④">credential record</a>.</p>
      </ol>
    </ol>
    <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
    <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">navigator.credentials.get()</a></code> call,
-then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">navigator.credentials.get()</a></code> call,
+then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Let <var>recognizedSpks</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>.</p>
@@ -7800,7 +7799,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public
            <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
           <dt data-md>does not equal <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt②">attStmt</a> by binary equality:
           <dd data-md>
-           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②④">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②④">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
            <p>If the result is:</p>
            <dl class="switch">
             <dt data-md>successful
@@ -7830,10 +7829,10 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public
            <dl class="switch">
             <dt data-md>If <var>fmt</var>’s value is "none":
             <dd data-md>
-             <p>There is no attestation signature to verify and this is a new supplemental key. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a> and then continue to the next iteration, if any.</p>
+             <p>There is no attestation signature to verify and this is a new supplemental key. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a> and then continue to the next iteration, if any.</p>
             <dt data-md>Otherwise:
             <dd data-md>
-             <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑦">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+             <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑦">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
              <p>If the result is:</p>
              <dl class="switch">
               <dt data-md>successful
@@ -7845,12 +7844,12 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public
              </dl>
            </dl>
           <li data-md>
-           <p>Otherwise there is some form of error: we recieved a known <var>spk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> has stored along with that <var>spk</var> value. Terminate these verification steps.</p>
+           <p>Otherwise there is some form of error: we recieved a known <var>spk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> has stored along with that <var>spk</var> value. Terminate these verification steps.</p>
          </ol>
        </dl>
      </ol>
    </ol>
-   <p>At the end of these steps, <var>recognizedSpks</var> contains zero or more <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①④">supplemental public keys</a> that were previously known for this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②①">user credential</a>. These keys make claims about the continuity of certain factors between this authentication attempt and previous ones. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> should judge those claims in light of the attestations provided, if any, and evaluate the risk of this authentication in light of this information.</p>
+   <p>At the end of these steps, <var>recognizedSpks</var> contains zero or more <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①④">supplemental public keys</a> that were previously known for this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②①">user credential</a>. These keys make claims about the continuity of certain factors between this authentication attempt and previous ones. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> should judge those claims in light of the attestations provided, if any, and evaluate the risk of this authentication in light of this information.</p>
    <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a>.</p>
    <p>To <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</dfn>, perform the following steps:</p>
    <ol>
@@ -7997,11 +7996,11 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p class="note" role="note"><span class="marker">Note:</span> This property has no effect if the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">Virtual Authenticator</a> does not support the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method②">User Verification Method</a> extension.</p>
     <dt data-md><var>defaultBackupEligibility</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">Public Key Credential Source</a>.
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a>.
 This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
     <dt data-md><var>defaultBackupState</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">Public Key Credential Source</a>.
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">Public Key Credential Source</a>.
 This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②③">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①③">virtual authenticator</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-authenticator"><span class="secno">11.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-virtual-authenticator">Add Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-add-virtual-authenticator"></a></h3>
@@ -8156,7 +8155,7 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -8200,24 +8199,24 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <td>string
       <tr>
        <td><var>signCount</var>
-       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">public key credential source</a>.
+       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>.
        <td>number
       <tr>
        <td><var>largeBlob</var>
-       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a>.
+       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a>.
                     This property may not be defined. 
        <td>string
       <tr>
        <td><var>backupEligibility</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
+       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
                     The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>. 
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. 
        <td>boolean
       <tr>
        <td><var>backupState</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②①">virtual authenticator</a>'s <var>defaultBackupState</var> property.
+       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②①">virtual authenticator</a>'s <var>defaultBackupState</var> property.
                     The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②③">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. 
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②③">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">public key credential source</a>. 
        <td>boolean
     </table>
    </figure>
@@ -8323,7 +8322,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a>, regardless of whether they were
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a>, regardless of whether they were
 stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
@@ -8345,13 +8344,13 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
     <li data-md>
      <p>Let <var>credentialsArray</var> be an empty array.</p>
     <li data-md>
-     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
+     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
 construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -8372,14 +8371,14 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
     <li data-md>
      <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
-     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
+     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
+     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑨">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑨">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -8398,7 +8397,7 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⓪">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②①">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③①">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③①">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
@@ -8435,7 +8434,7 @@ <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verif
    </ol>
    <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credential-properties"><span class="secno">11.10. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-credential-properties">Set Credential Properties</dfn></span><a class="self-link" href="#sctn-automation-set-credential-properties"></a></h3>
    <p>The <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties">Set Credential Properties</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands①⓪">extension command</a> allows setting the <var>backupEligibility</var> and <var>backupState</var> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑧">credential properties</a> of
-a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑤">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">public key credential source</a>. It is defined as follows:</p>
+a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑤">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑥">public key credential source</a>. It is defined as follows:</p>
    <figure class="table" id="table-setFlags">
     <table class="data">
      <thead>
@@ -8477,14 +8476,14 @@ <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credentia
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑧">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑥">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
+     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑦">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
     <li data-md>
      <p>If <var>credential</var> is empty, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑦">invalid argument</a>.</p>
     <li data-md>
      <p>Let <var>backupEligibility</var> be the <var>parameters</var>’ <var>backupEligibility</var> property.</p>
     <li data-md>
      <p>If <var>backupEligibility</var> is defined, set the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑨">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties①①">credential property</a> of <var>credential</var> to the value of <var>backupEligibility</var>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑧">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
     <li data-md>
      <p>Let <var>backupState</var> be the <var>parameters</var>’ <var>backupState</var> property.</p>
     <li data-md>
@@ -8587,7 +8586,7 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⑤">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⑤">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
@@ -8595,15 +8594,15 @@ <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><s
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
 The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> as to their provenance.</p>
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
 Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
@@ -8624,7 +8623,7 @@ <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-prox
 then the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> has to trust the third party to
 enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> for other users.</p>
    <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a>,
 or where <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> do not communicate directly,
@@ -8646,38 +8645,38 @@ <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span cl
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
    <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> can optionally
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> can optionally
 enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticators</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
 Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
 methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
 to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①③">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>Challenges SHOULD be valid for a duration similar to the
@@ -8690,88 +8689,88 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
 may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> qualities.
 For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> was generated
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> was generated
 by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⓪">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
    <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑧">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>: unscathed
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> reports
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> reports
 a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> also
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> also
 un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
    <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
    <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticators</a>.
 In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
 different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
 For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>.
 The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
 and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a>.</p>
     <li data-md>
      <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a>.
 For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑧">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
    </ul>
    <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><span class="secno">13.4.9. </span><span class="content">Validating the origin of a credential</span><a class="self-link" href="#sctn-validating-origin"></a></h4>
    <p>When <a href="#rp-op-registering-a-new-credential-step-origin">registering a credential</a> and
 when <a href="#rp-op-verifying-assertion-step-origin">verifying an assertion</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
-   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
+   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
 as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credentials</a>.
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of WebAuthn credentials prevents their use on domains
 outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤②">RP ID</a> they were registered for,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a>'s origin validation serves as an additional layer of protection
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a>'s origin validation serves as an additional layer of protection
 in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
-   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>.
+   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8786,11 +8785,11 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
      <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.</p>
     <li data-md>
      <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑧">origin</a></code> to be an operating system dependent
-identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
+identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
    <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> MUST validate that its value is expected.
-This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> MUST validate that its value is expected.
+This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8808,7 +8807,7 @@ <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><sp
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -8822,53 +8821,53 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
      <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
 private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>, but in
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>, but in
 the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> depending on the implementation.</p>
     <li data-md>
      <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
     <li data-md>
      <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
    <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a>.</p>
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑦">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a> thus cannot correlate users between their
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
    <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
 authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a>.</p>
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a>.</p>
    <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
@@ -8904,33 +8903,33 @@ <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span clas
    <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a>:</p>
    <ul>
     <li data-md>
      <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticators</a> are present.</p>
     <li data-md>
      <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> could identify the user by probing for
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
 timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> could identify the user by probing
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
 failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> parameter is
 available to the user.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
@@ -8940,39 +8939,39 @@ <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><sp
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑥">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
 and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
    <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a> responds with a failure, but then
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a> responds with a failure, but then
 successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a> may implement to mitigate or prevent information
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
      <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
@@ -8992,7 +8991,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> member could therefore be populated with pseudo-random values
@@ -9009,17 +9008,17 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤②">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①③">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①③">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Parties</a>,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Parties</a>,
 but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Parties</a>,
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤②">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
 given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑤">Relying Party</a> could for example:</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
@@ -9031,12 +9030,12 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
    </ul>
    <p>If the above prevention measures are not available,
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑥">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
    <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑦">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑧">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -11229,12 +11228,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "abstract-opdef-credential-record-authenticatordisplayname": {"dfnID":"abstract-opdef-credential-record-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2460"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2461"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#abstract-opdef-credential-record-authenticatordisplayname"},
 "abstract-opdef-credential-record-backupeligible": {"dfnID":"abstract-opdef-credential-record-backupeligible","dfnText":"backupEligible","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2461"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupeligible"},
 "abstract-opdef-credential-record-backupstate": {"dfnID":"abstract-opdef-credential-record-backupstate","dfnText":"backupState","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupstate"},
-"abstract-opdef-credential-record-id": {"dfnID":"abstract-opdef-credential-record-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2461"},{"id":"ref-for-abstract-opdef-credential-record-id\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-id"},
+"abstract-opdef-credential-record-id": {"dfnID":"abstract-opdef-credential-record-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2462"},{"id":"ref-for-abstract-opdef-credential-record-id\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-id"},
 "abstract-opdef-credential-record-publickey": {"dfnID":"abstract-opdef-credential-record-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-publickey"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-publickey\u2460"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-publickey"},
 "abstract-opdef-credential-record-signcount": {"dfnID":"abstract-opdef-credential-record-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-signcount"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-signcount\u2460"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2461"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2462"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2463"},{"id":"ref-for-abstract-opdef-credential-record-signcount\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-signcount"},
 "abstract-opdef-credential-record-supplementalpubkeys": {"dfnID":"abstract-opdef-credential-record-supplementalpubkeys","dfnText":"supplementalPubKeys","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2460"},{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2461"},{"id":"ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2462"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-credential-record-supplementalpubkeys"},
-"abstract-opdef-credential-record-transports": {"dfnID":"abstract-opdef-credential-record-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2460"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-transports"},
-"abstract-opdef-credential-record-type": {"dfnID":"abstract-opdef-credential-record-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2460"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-type"},
+"abstract-opdef-credential-record-transports": {"dfnID":"abstract-opdef-credential-record-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-transports"},
+"abstract-opdef-credential-record-type": {"dfnID":"abstract-opdef-credential-record-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-type"},
 "abstract-opdef-credential-record-uvinitialized": {"dfnID":"abstract-opdef-credential-record-uvinitialized","dfnText":"uvInitialized","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized"},{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-uvinitialized"},
 "abstract-opdef-supplementalpubkeys-record-aaguid": {"dfnID":"abstract-opdef-supplementalpubkeys-record-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2461"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-aaguid"},
 "abstract-opdef-supplementalpubkeys-record-attstmt": {"dfnID":"abstract-opdef-supplementalpubkeys-record-attstmt","dfnText":"attStmt","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2461"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2462"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-attstmt"},
@@ -11384,7 +11383,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "create-candidate-authenticator": {"dfnID":"create-candidate-authenticator","dfnText":"candidate authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-candidate-authenticator"},{"id":"ref-for-create-candidate-authenticator\u2460"},{"id":"ref-for-create-candidate-authenticator\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-candidate-authenticator"},
 "create-selected-authenticator": {"dfnID":"create-selected-authenticator","dfnText":"selected authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-selected-authenticator"},{"id":"ref-for-create-selected-authenticator\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-selected-authenticator"},
 "created-on": {"dfnID":"created-on","dfnText":"created on","external":false,"refSections":[{"refs":[{"id":"ref-for-created-on"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-created-on\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#created-on"},
-"credential-descriptor-for-a-credential-record": {"dfnID":"credential-descriptor-for-a-credential-record","dfnText":"credential descriptor for a credential record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-descriptor-for-a-credential-record"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#credential-descriptor-for-a-credential-record"},
+"credential-descriptor-for-a-credential-record": {"dfnID":"credential-descriptor-for-a-credential-record","dfnText":"credential descriptor for a credential record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-descriptor-for-a-credential-record"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-descriptor-for-a-credential-record\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}],"url":"#credential-descriptor-for-a-credential-record"},
 "credential-id": {"dfnID":"credential-id","dfnText":"Credential ID","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-id"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-id\u2460"},{"id":"ref-for-credential-id\u2461"},{"id":"ref-for-credential-id\u2462"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credential-id\u2463"},{"id":"ref-for-credential-id\u2464"},{"id":"ref-for-credential-id\u2465"},{"id":"ref-for-credential-id\u2466"},{"id":"ref-for-credential-id\u2467"},{"id":"ref-for-credential-id\u2468"},{"id":"ref-for-credential-id\u2460\u24ea"},{"id":"ref-for-credential-id\u2460\u2460"},{"id":"ref-for-credential-id\u2460\u2461"},{"id":"ref-for-credential-id\u2460\u2462"},{"id":"ref-for-credential-id\u2460\u2463"},{"id":"ref-for-credential-id\u2460\u2464"},{"id":"ref-for-credential-id\u2460\u2465"},{"id":"ref-for-credential-id\u2460\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-id\u2460\u2467"},{"id":"ref-for-credential-id\u2460\u2468"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-id\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-credential-id\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-credential-id\u2461\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-id\u2461\u2463"},{"id":"ref-for-credential-id\u2461\u2464"},{"id":"ref-for-credential-id\u2461\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-credential-id\u2461\u2466"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-credential-id\u2461\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-credential-id\u2461\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u24ea"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-credential-id\u2462\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-id\u2462\u2461"},{"id":"ref-for-credential-id\u2462\u2462"},{"id":"ref-for-credential-id\u2462\u2463"},{"id":"ref-for-credential-id\u2462\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-id\u2462\u2465"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-id\u2462\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-credential-id\u2462\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-credential-id\u2462\u2468"},{"id":"ref-for-credential-id\u2463\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2460"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-credential-id\u2463\u2461"},{"id":"ref-for-credential-id\u2463\u2462"},{"id":"ref-for-credential-id\u2463\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-id\u2463\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-id\u2463\u2465"},{"id":"ref-for-credential-id\u2463\u2466"},{"id":"ref-for-credential-id\u2463\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-credential-id\u2463\u2468"},{"id":"ref-for-credential-id\u2464\u24ea"},{"id":"ref-for-credential-id\u2464\u2460"},{"id":"ref-for-credential-id\u2464\u2461"},{"id":"ref-for-credential-id\u2464\u2462"},{"id":"ref-for-credential-id\u2464\u2463"},{"id":"ref-for-credential-id\u2464\u2464"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"#credential-id"},
 "credential-id-looking-up": {"dfnID":"credential-id-looking-up","dfnText":"looking up","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-id-looking-up"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-credential-id-looking-up\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#credential-id-looking-up"},
 "credential-key-pair": {"dfnID":"credential-key-pair","dfnText":"Credential Key Pair","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-key-pair"},{"id":"ref-for-credential-key-pair\u2460"},{"id":"ref-for-credential-key-pair\u2461"},{"id":"ref-for-credential-key-pair\u2462"},{"id":"ref-for-credential-key-pair\u2463"},{"id":"ref-for-credential-key-pair\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-key-pair\u2465"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-credential-key-pair\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-key-pair"},
@@ -11392,7 +11391,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "credential-private-key": {"dfnID":"credential-private-key","dfnText":"Credential Private Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-private-key"},{"id":"ref-for-credential-private-key\u2460"},{"id":"ref-for-credential-private-key\u2461"},{"id":"ref-for-credential-private-key\u2462"},{"id":"ref-for-credential-private-key\u2463"},{"id":"ref-for-credential-private-key\u2464"},{"id":"ref-for-credential-private-key\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-private-key\u2466"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-private-key\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-credential-private-key\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u24ea"},{"id":"ref-for-credential-private-key\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2461"},{"id":"ref-for-credential-private-key\u2460\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2463"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2466"},{"id":"ref-for-credential-private-key\u2460\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2468"},{"id":"ref-for-credential-private-key\u2461\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-credential-private-key\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#credential-private-key"},
 "credential-properties": {"dfnID":"credential-properties","dfnText":"Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-properties"},{"id":"ref-for-credential-properties\u2460"},{"id":"ref-for-credential-properties\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-properties\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-properties\u2463"},{"id":"ref-for-credential-properties\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-credential-properties\u2465"},{"id":"ref-for-credential-properties\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-properties\u2467"},{"id":"ref-for-credential-properties\u2468"},{"id":"ref-for-credential-properties\u2460\u24ea"},{"id":"ref-for-credential-properties\u2460\u2460"},{"id":"ref-for-credential-properties\u2460\u2461"}],"title":"11.10. Set Credential Properties"}],"url":"#credential-properties"},
 "credential-public-key": {"dfnID":"credential-public-key","dfnText":"Credential Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-public-key"},{"id":"ref-for-credential-public-key\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-public-key\u2461"},{"id":"ref-for-credential-public-key\u2462"},{"id":"ref-for-credential-public-key\u2463"},{"id":"ref-for-credential-public-key\u2464"},{"id":"ref-for-credential-public-key\u2465"},{"id":"ref-for-credential-public-key\u2466"},{"id":"ref-for-credential-public-key\u2467"},{"id":"ref-for-credential-public-key\u2468"},{"id":"ref-for-credential-public-key\u2460\u24ea"},{"id":"ref-for-credential-public-key\u2460\u2460"},{"id":"ref-for-credential-public-key\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2463"},{"id":"ref-for-credential-public-key\u2460\u2464"},{"id":"ref-for-credential-public-key\u2460\u2465"},{"id":"ref-for-credential-public-key\u2460\u2466"},{"id":"ref-for-credential-public-key\u2460\u2467"},{"id":"ref-for-credential-public-key\u2460\u2468"},{"id":"ref-for-credential-public-key\u2461\u24ea"},{"id":"ref-for-credential-public-key\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2461"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2463"},{"id":"ref-for-credential-public-key\u2461\u2464"},{"id":"ref-for-credential-public-key\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2466"},{"id":"ref-for-credential-public-key\u2461\u2467"},{"id":"ref-for-credential-public-key\u2461\u2468"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u24ea"},{"id":"ref-for-credential-public-key\u2462\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2462"},{"id":"ref-for-credential-public-key\u2462\u2463"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2465"},{"id":"ref-for-credential-public-key\u2462\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2468"},{"id":"ref-for-credential-public-key\u2463\u24ea"},{"id":"ref-for-credential-public-key\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-public-key"},
-"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"},{"id":"ref-for-credential-record\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2468"},{"id":"ref-for-credential-record\u2460\u24ea"},{"id":"ref-for-credential-record\u2460\u2460"},{"id":"ref-for-credential-record\u2460\u2461"},{"id":"ref-for-credential-record\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"},{"id":"ref-for-credential-record\u2460\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-record\u2460\u2467"},{"id":"ref-for-credential-record\u2460\u2468"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-credential-record\u2461\u24ea"}],"title":"10.2.2.3.1. Registration (create())"}],"url":"#credential-record"},
+"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"},{"id":"ref-for-credential-record\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"},{"id":"ref-for-credential-record\u2468"},{"id":"ref-for-credential-record\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-record\u2460\u2460"},{"id":"ref-for-credential-record\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2460\u2462"},{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"},{"id":"ref-for-credential-record\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-record\u2460\u2467"},{"id":"ref-for-credential-record\u2460\u2468"},{"id":"ref-for-credential-record\u2461\u24ea"},{"id":"ref-for-credential-record\u2461\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-record\u2461\u2461"},{"id":"ref-for-credential-record\u2461\u2462"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-credential-record\u2461\u2463"}],"title":"10.2.2.3.1. Registration (create())"}],"url":"#credential-record"},
 "credential-record-supplemental-public-key-record": {"dfnID":"credential-record-supplemental-public-key-record","dfnText":"supplemental public key record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record\u2460"},{"id":"ref-for-credential-record-supplemental-public-key-record\u2461"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-credential-record-supplemental-public-key-record\u2462"},{"id":"ref-for-credential-record-supplemental-public-key-record\u2463"}],"title":"10.2.2.3.2. Authentication (get())"}],"url":"#credential-record-supplemental-public-key-record"},
 "credential-storage-modality": {"dfnID":"credential-storage-modality","dfnText":"credential storage\nmodality","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-storage-modality"},{"id":"ref-for-credential-storage-modality\u2460"},{"id":"ref-for-credential-storage-modality\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#credential-storage-modality"},
 "credentialcreationdata-attestationconveyancepreferenceoption": {"dfnID":"credentialcreationdata-attestationconveyancepreferenceoption","dfnText":"attestationConveyancePreferenceOption","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationconveyancepreferenceoption"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
@@ -11436,7 +11435,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dictdef-credentialpropertiesoutput": {"dfnID":"dictdef-credentialpropertiesoutput","dfnText":"CredentialPropertiesOutput","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialpropertiesoutput"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dictdef-credentialpropertiesoutput"},
 "dictdef-publickeycredentialcreationoptions": {"dfnID":"dictdef-publickeycredentialcreationoptions","dfnText":"PublicKeyCredentialCreationOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2461"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2462"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2463"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2467"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2468"},{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptions\u2460\u2462"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dictdef-publickeycredentialcreationoptions"},
 "dictdef-publickeycredentialcreationoptionsjson": {"dfnID":"dictdef-publickeycredentialcreationoptionsjson","dfnText":"PublicKeyCredentialCreationOptionsJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialcreationoptionsjson"},{"id":"ref-for-dictdef-publickeycredentialcreationoptionsjson\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}],"url":"#dictdef-publickeycredentialcreationoptionsjson"},
-"dictdef-publickeycredentialdescriptor": {"dfnID":"dictdef-publickeycredentialdescriptor","dfnText":"PublicKeyCredentialDescriptor","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2461"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2462"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2464"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2466"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2468"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"#dictdef-publickeycredentialdescriptor"},
+"dictdef-publickeycredentialdescriptor": {"dfnID":"dictdef-publickeycredentialdescriptor","dfnText":"PublicKeyCredentialDescriptor","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2461"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2462"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2464"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2466"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2468"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"},{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptor"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"#dictdef-publickeycredentialdescriptor"},
 "dictdef-publickeycredentialdescriptorjson": {"dfnID":"dictdef-publickeycredentialdescriptorjson","dfnText":"PublicKeyCredentialDescriptorJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptorjson"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialdescriptorjson\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"#dictdef-publickeycredentialdescriptorjson"},
 "dictdef-publickeycredentialentity": {"dfnID":"dictdef-publickeycredentialentity","dfnText":"PublicKeyCredentialEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity"},{"id":"ref-for-dictdef-publickeycredentialentity\u2460"},{"id":"ref-for-dictdef-publickeycredentialentity\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity\u2462"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialentity\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"#dictdef-publickeycredentialentity"},
 "dictdef-publickeycredentialparameters": {"dfnID":"dictdef-publickeycredentialparameters","dfnText":"PublicKeyCredentialParameters","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters\u2460"},{"id":"ref-for-dictdef-publickeycredentialparameters\u2461"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialparameters\u2462"},{"id":"ref-for-dictdef-publickeycredentialparameters\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dictdef-publickeycredentialparameters"},
@@ -11506,7 +11505,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-authenticatorattestationresponse-getauthenticatordata": {"dfnID":"dom-authenticatorattestationresponse-getauthenticatordata","dfnText":"getAuthenticatorData","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata\u2460"},{"id":"ref-for-dom-authenticatorattestationresponse-getauthenticatordata\u2461"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getauthenticatordata"},
 "dom-authenticatorattestationresponse-getpublickey": {"dfnID":"dom-authenticatorattestationresponse-getpublickey","dfnText":"getPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2461"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2462"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2463"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2464"},{"id":"ref-for-dom-authenticatorattestationresponse-getpublickey\u2465"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getpublickey"},
 "dom-authenticatorattestationresponse-getpublickeyalgorithm": {"dfnID":"dom-authenticatorattestationresponse-getpublickeyalgorithm","dfnText":"getPublicKeyAlgorithm","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm\u2461"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"#dom-authenticatorattestationresponse-getpublickeyalgorithm"},
-"dom-authenticatorattestationresponse-gettransports": {"dfnID":"dom-authenticatorattestationresponse-gettransports","dfnText":"getTransports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports"},{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2463"},{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2465"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2466"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-authenticatorattestationresponse-gettransports"},
+"dom-authenticatorattestationresponse-gettransports": {"dfnID":"dom-authenticatorattestationresponse-gettransports","dfnText":"getTransports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports"},{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2464"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-gettransports\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-authenticatorattestationresponse-gettransports"},
 "dom-authenticatorattestationresponse-transports-slot": {"dfnID":"dom-authenticatorattestationresponse-transports-slot","dfnText":"[[transports]]","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorattestationresponse-transports-slot\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}],"url":"#dom-authenticatorattestationresponse-transports-slot"},
 "dom-authenticatorattestationresponsejson-attestationobject": {"dfnID":"dom-authenticatorattestationresponsejson-attestationobject","dfnText":"attestationObject","external":false,"refSections":[],"url":"#dom-authenticatorattestationresponsejson-attestationobject"},
 "dom-authenticatorattestationresponsejson-authenticatordata": {"dfnID":"dom-authenticatorattestationresponsejson-authenticatordata","dfnText":"authenticatorData","external":false,"refSections":[],"url":"#dom-authenticatorattestationresponsejson-authenticatordata"},
@@ -11599,7 +11598,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialcreationoptionsjson-timeout": {"dfnID":"dom-publickeycredentialcreationoptionsjson-timeout","dfnText":"timeout","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-timeout"},
 "dom-publickeycredentialcreationoptionsjson-user": {"dfnID":"dom-publickeycredentialcreationoptionsjson-user","dfnText":"user","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-user"},
 "dom-publickeycredentialdescriptor-id": {"dfnID":"dom-publickeycredentialdescriptor-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2467"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredentialdescriptor-id"},
-"dom-publickeycredentialdescriptor-transports": {"dfnID":"dom-publickeycredentialdescriptor-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2464"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialdescriptor-transports"},
+"dom-publickeycredentialdescriptor-transports": {"dfnID":"dom-publickeycredentialdescriptor-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2464"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialdescriptor-transports"},
 "dom-publickeycredentialdescriptor-type": {"dfnID":"dom-publickeycredentialdescriptor-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialdescriptor-type"},
 "dom-publickeycredentialdescriptorjson-id": {"dfnID":"dom-publickeycredentialdescriptorjson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-id"},
 "dom-publickeycredentialdescriptorjson-transports": {"dfnID":"dom-publickeycredentialdescriptorjson-transports","dfnText":"transports","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-transports"},
@@ -11702,7 +11701,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "platform-credential": {"dfnID":"platform-credential","dfnText":"platform credential","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-credential\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-credential\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-platform-credential\u2462"},{"id":"ref-for-platform-credential\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#platform-credential"},
 "prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
 "public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"},{"id":"ref-for-public-key-credential\u2462\u2465"},{"id":"ref-for-public-key-credential\u2462\u2466"},{"id":"ref-for-public-key-credential\u2462\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"},{"id":"ref-for-public-key-credential\u2463\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2463"},{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2468"},{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"},{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"},{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"},{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2467"},{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"},{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"},{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"},{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},
-"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"},{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"},{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"},{"id":"ref-for-public-key-credential-source\u2463\u2468"},{"id":"ref-for-public-key-credential-source\u2464\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2460"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"},{"id":"ref-for-public-key-credential-source\u2464\u2463"},{"id":"ref-for-public-key-credential-source\u2464\u2464"},{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2460"},{"id":"ref-for-public-key-credential-source\u2465\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2464"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"},{"id":"ref-for-public-key-credential-source\u2465\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2468"},{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"},{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2465"},{"id":"ref-for-public-key-credential-source\u2466\u2466"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2467"},{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2460"},{"id":"ref-for-public-key-credential-source\u2467\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2462"},{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
+"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"},{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"},{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"},{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"},{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"},{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2460"},{"id":"ref-for-public-key-credential-source\u2465\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"},{"id":"ref-for-public-key-credential-source\u2465\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2468"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"},{"id":"ref-for-public-key-credential-source\u2466\u2466"},{"id":"ref-for-public-key-credential-source\u2466\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2460"},{"id":"ref-for-public-key-credential-source\u2467\u2461"},{"id":"ref-for-public-key-credential-source\u2467\u2462"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2465"},{"id":"ref-for-public-key-credential-source\u2467\u2466"},{"id":"ref-for-public-key-credential-source\u2467\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
 "public-key-credential-source-id": {"dfnID":"public-key-credential-source-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-id"},{"id":"ref-for-public-key-credential-source-id\u2460"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2464"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2465"},{"id":"ref-for-public-key-credential-source-id\u2466"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-id"},
 "public-key-credential-source-managing-authenticator": {"dfnID":"public-key-credential-source-managing-authenticator","dfnText":"managing authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2462"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2463"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2464"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2465"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2466"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2468"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#public-key-credential-source-managing-authenticator"},
 "public-key-credential-source-mutable-item": {"dfnID":"public-key-credential-source-mutable-item","dfnText":"mutable item","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-mutable-item"}],"title":"4. Terminology"}],"url":"#public-key-credential-source-mutable-item"},
@@ -11720,7 +11719,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
 "registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"},{"id":"ref-for-registration-ceremony\u2460\u2460"},{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"},{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"},{"id":"ref-for-registration-ceremony\u2461\u2460"},{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2464"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
 "registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2462"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2463"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2464"},{"id":"ref-for-registration-extension\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
-"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"},{"id":"ref-for-relying-party\u2467\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"},{"id":"ref-for-relying-party\u2468\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"},{"id":"ref-for-relying-party\u2468\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u24ea"},{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2463"},{"id":"ref-for-relying-party\u2460\u24ea\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"},{"id":"ref-for-relying-party\u2460\u24ea\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"},{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"},{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2467"},{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"},{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2460"},{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"},{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2461"},{"id":"ref-for-relying-party\u2460\u2468\u2462"},{"id":"ref-for-relying-party\u2460\u2468\u2463"},{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2466"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"},{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2467"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"},{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2461\u2468"},{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2465"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2466"},{"id":"ref-for-relying-party\u2461\u2468\u2467"},{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2460"},{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"},{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"},{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2464"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2468"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u24ea"}],"title":"10.2.2.2.2. Attestation calculations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2460"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2462"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2463"},{"id":"ref-for-relying-party\u2463\u2462\u2464"},{"id":"ref-for-relying-party\u2463\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2466"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2467"},{"id":"ref-for-relying-party\u2463\u2462\u2468"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2463\u2468"},{"id":"ref-for-relying-party\u2463\u2464\u24ea"},{"id":"ref-for-relying-party\u2463\u2464\u2460"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2461"},{"id":"ref-for-relying-party\u2463\u2464\u2462"},{"id":"ref-for-relying-party\u2463\u2464\u2463"},{"id":"ref-for-relying-party\u2463\u2464\u2464"},{"id":"ref-for-relying-party\u2463\u2464\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
+"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"},{"id":"ref-for-relying-party\u2467\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"},{"id":"ref-for-relying-party\u2468\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"},{"id":"ref-for-relying-party\u2468\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u24ea"},{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2463"},{"id":"ref-for-relying-party\u2460\u24ea\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"},{"id":"ref-for-relying-party\u2460\u24ea\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"},{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"},{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2467"},{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"},{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2467"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"},{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"},{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2468"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"},{"id":"ref-for-relying-party\u2460\u2468\u2462"},{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"},{"id":"ref-for-relying-party\u2461\u2460\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"},{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2462"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2463"},{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2461\u2468"},{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"},{"id":"ref-for-relying-party\u2461\u2468\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2463"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2468"},{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"},{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"},{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"},{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"},{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"},{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2462"}],"title":"10.2.1. User Verification Method Extension (uvm)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"}],"title":"10.2.2. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"},{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"}],"title":"10.2.2.1. Relying Party Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"},{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"10.2.2.2. Extension Definition"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"}],"title":"10.2.2.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2467"}],"title":"10.2.2.2.2. Attestation calculations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2468"}],"title":"10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"}],"title":"10.2.2.3.1. Registration (create())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"},{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"}],"title":"10.2.2.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2460"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"},{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"},{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2464"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"},{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"},{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"},{"id":"ref-for-relying-party\u2463\u2462\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2464"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2465"},{"id":"ref-for-relying-party\u2463\u2462\u2466"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2467"},{"id":"ref-for-relying-party\u2463\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2463\u2468"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u24ea"},{"id":"ref-for-relying-party\u2463\u2464\u2460"},{"id":"ref-for-relying-party\u2463\u2464\u2461"},{"id":"ref-for-relying-party\u2463\u2464\u2462"},{"id":"ref-for-relying-party\u2463\u2464\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2464"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2464\u2465"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},
 "remove-all-credentials": {"dfnID":"remove-all-credentials","dfnText":"Remove All Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-all-credentials"}],"title":"11.8. Remove All Credentials"}],"url":"#remove-all-credentials"},
 "remove-credential": {"dfnID":"remove-credential","dfnText":"Remove Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-credential"}],"title":"11.7. Remove Credential"}],"url":"#remove-credential"},