From 71507296ec54b07b2e75821f95238c5b15459ad5 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Tue, 24 Sep 2024 16:16:26 +0000
Subject: [PATCH] Merge pull request #2134 from
 w3c/issue-2132-obsolete-privacy-cons

SHA: adf7a95537499f79ad72a76422836116387c246e
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 144 +++++++++++++++++++++++++++--------------------------
 1 file changed, 73 insertions(+), 71 deletions(-)

diff --git a/index.html b/index.html
index 0780358d0..6a53fd0fd 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 6270e4735, updated Tue Aug 6 12:12:30 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="199dcdad48045aca69bab819bf54e0fe59aeb066" name="revision">
+  <meta content="adf7a95537499f79ad72a76422836116387c246e" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -3086,8 +3086,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>. In order to prevent information leak that could identify the
-user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑧">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for details.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
     </ol>
     <p>During the above process, the user agent SHOULD show some UI to the user to guide them in the process of selecting and
 authorizing an authenticator. When <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑤">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⓪">conditional</a></code>, prominent modal UI should <i>not</i> be shown <i>unless</i> credential creation was previously consented to via means determined by the user agent.</p>
@@ -3112,7 +3111,7 @@ <h5 class="heading settled" data-level="5.1.3.1" id="sctn-create-request-excepti
 or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②">userVerification</a></code> was set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required②">required</a></code> and no available authenticator could perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a>.</p>
     <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>
     <dd data-md>
-     <p>The authenticator used in the ceremony recognized an entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①">excludeCredentials</a></code> after the user <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">consented</a> to registering a credential.</p>
+     <p>The authenticator used in the ceremony recognized an entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①">excludeCredentials</a></code> after the user <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑧">consented</a> to registering a credential.</p>
     <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>
     <dd data-md>
      <p>No entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code> had a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code> property of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key③">public-key</a></code>,
@@ -3139,7 +3138,7 @@ <h5 class="heading settled" data-level="5.1.3.1" id="sctn-create-request-excepti
    </dl>
    <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> script optionally specifies some criteria
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> script optionally specifies some criteria
 to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
 decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
@@ -3480,8 +3479,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>. In order to prevent information leak that could identify the
-user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a> for details.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
     </ol>
    </div>
    <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2. </span><span class="content"><dfn class="dfn-paneled algorithm" data-algorithm="Issuing a credential request to an authenticator" data-dfn-for="PublicKeyCredential" data-dfn-type="dfn" data-noexport id="publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</dfn></span><a class="self-link" href="#sctn-issuing-cred-request-to-authenticator"></a></h5>
@@ -3780,7 +3778,7 @@ <h4 class="heading settled" data-level="5.1.10" id="sctn-signal-methods"><span c
 functionality opportunistically, since an authenticator may not support updating
 its <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a> or may not be attached at the time the request is
 made. Furthermore, in order to avoid revealing information about a user’s
-credentials without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a>, <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods①">signal methods</a> do not indicate whether
+credentials without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">user consent</a>, <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods①">signal methods</a> do not indicate whether
 the operation succeeded. A successfully resolved promise only means that the <code>options</code> object was well formed.</p>
    <p>Each <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods②">signal method</a> includes <dfn class="dfn-paneled" data-dfn-for="signal method" data-dfn-type="dfn" data-lt="authenticator actions" data-noexport id="signal-method-authenticator-actions">authenticator
 actions</dfn>. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">Authenticators</a> MAY choose to deviate in their <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions">authenticator actions</a> from the present specification, e.g. to ignore a
@@ -3791,7 +3789,7 @@ <h4 class="heading settled" data-level="5.1.10" id="sctn-signal-methods"><span c
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods④">Signal methods</a> intentionally avoid waiting for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticators</a> to
 complete executing the <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions③">authenticator actions</a>. This measure protects users
 from <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Parties</a> gaining information about availability of their credentials
-without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> based on the timing of the request.</p>
+without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> based on the timing of the request.</p>
    <h5 class="heading settled" data-level="5.1.10.1" id="sctn-signal-methods-async-rp-id-validation"><span class="secno">5.1.10.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-asynchronous-rp-id-validation-algorithm">Asynchronous RP ID validation algorithm</dfn></span><a class="self-link" href="#sctn-signal-methods-async-rp-id-validation"></a></h5>
    <p>The <a data-link-type="abstract-op" href="#abstract-opdef-asynchronous-rp-id-validation-algorithm" id="ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm">Asynchronous RP ID validation algorithm</a> lets <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑤">signal methods</a> validate <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP IDs</a> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a>. The algorithm takes a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a></code> <var>rpId</var> as input
 and returns a promise that rejects if the validation fails. The steps are:</p>
@@ -4067,7 +4065,7 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
    <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a>'s response to a client’s request for
 generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
-optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">user consent</a> to a specific transaction.</p>
+optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse④"><c- g>AuthenticatorAssertionResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑥"><c- n>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
@@ -4423,7 +4421,7 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a>, or to save a
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
 If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
 the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
@@ -5165,10 +5163,10 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="assertion-signature">assertion signature</dfn> is produced when the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑦">authenticatorGetAssertion</a> method is invoked. It represents an
-assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">consented</a> to a specific transaction, such as logging
+assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to a specific transaction, such as logging
 in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
-same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a>. It also asserts additional
-information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">user consent</a> was
+same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a>. It also asserts additional
+information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user consent</a> was
 provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
    </ol>
    <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
@@ -5628,7 +5626,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
       <li data-md>
        <p>If <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑦">id</a></code></code> in this authenticator
 returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code></code> respectively,
-then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">user
+then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user
 consent</a> for creating a new credential. The <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test
 of user presence</a>. If the user</p>
        <dl class="switch">
@@ -5653,15 +5651,15 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>If <var>requireUserVerification</var> is <code>true</code> and the authenticator cannot perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a>, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror③">ConstraintError</a></code>" and terminate the operation.</p>
     <li id="op-makecred-step-user-consent">
-     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for creating a new credential.
+     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">user consent</a> for creating a new credential.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⓪">authorization gesture</a> is shown by the
     authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①④">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code></code>, if possible. 
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑨">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> fails, return an error code equivalent to
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> fails, return an error code equivalent to
     "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑤">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">user consent</a> has been obtained, generate a new credential object:</p>
+     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> has been obtained, generate a new credential object:</p>
      <ol>
       <li data-md>
        <p>Let (<var>publicKey</var>, <var>privateKey</var>) be a new pair of cryptographic keys using the combination of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①⓪">PublicKeyCredentialType</a></code> and cryptographic parameters represented by the first <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①⓪">item</a> in <var>credTypesAndPubKeyAlgs</var> that is supported by
@@ -5792,12 +5790,12 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑥">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
      <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
-    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> for using <var>selectedCredential</var>.
+    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> may be shown
     by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①①">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">consent</a>, return an error code equivalent to
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">consent</a>, return an error code equivalent to
     "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑦">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension
@@ -7497,8 +7495,8 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
            <p>If <var>authenticator</var> responds with <code>message:error:test-of-user-presence-required</code> (i.e., success):
 cease normal processing of this <var>authenticator</var> and indicate in a platform-specific manner
 that the authenticator is inapplicable. For example, this could be in the form of UI, or
-could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> from <var>authenticator</var> and, upon receipt, treating
-it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑥">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
+could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> from <var>authenticator</var> and, upon receipt, treating
+it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑥">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
 above except for setting <var>control byte</var> to <code>0x03</code> ("enforce-user-presence-and-sign"),
 and ignoring the response.</p>
          </ol>
@@ -7966,7 +7964,7 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">user verification</a>.</p>
     <dt data-md><var>isUserConsenting</var>
     <dd data-md>
-     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
+     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
     <dt data-md><var>isUserVerified</var>
     <dd data-md>
      <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
@@ -8820,7 +8818,7 @@ <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credenti
      <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①②③">client</a> ensures that its existence is not
 revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①②④">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">user
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user
 consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a> registered and available.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">public key credentials</a> are
@@ -8875,7 +8873,7 @@ <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span clas
    <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a>'s enrolled user(s).</p>
    <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
 could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>:</p>
    <ul>
     <li data-md>
@@ -8885,26 +8883,30 @@ <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy
    </ul>
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
-timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
-   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consented</a> to create a new credential before a
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
+before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
+   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③②">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
 leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credential</a> is not available.</p>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧③">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③③">consent</a> to use it.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧③">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to use it.</p>
    </ul>
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> could identify the user by probing
-for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧④">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③④">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧④">credentials</a> are available.
+For example, one such information leak may happen if the client displays instructions and controls
+for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a>.
+In this case, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> is aware of this <a data-link-type="dfn" href="#client" id="ref-for-client①③⓪">client</a> behavior,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⑤">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> parameter is
 available to the user.</p>
+   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> at any time,
+regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑤">credentials</a> are available.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
@@ -8912,39 +8914,39 @@ <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><sp
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
-and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> may implement to mitigate or prevent information
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> responds with a failure, but then
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
      <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
@@ -8957,23 +8959,23 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
 before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
@@ -8981,37 +8983,37 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑥">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑥">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑦">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑦">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑧">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> could for example:</p>
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>.</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
     <li data-md>
      <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
 so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> argument is not needed.</p>
    </ul>
    <p>If the above prevention measures are not available,
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑨">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <p>When <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑥">signalling</a> that a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥①">credential id</a> was not recognized,
 the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
 exposing <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥②">credential IDs</a> to an unauthenticated caller.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -11157,7 +11159,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "696a29e8": {"dfnID":"696a29e8","dfnText":"Request a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
 "6b815fdd": {"dfnID":"6b815fdd","dfnText":"is empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
 "6f944459": {"dfnID":"6f944459","dfnText":"same-origin with its ancestors","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin-with-its-ancestors"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
-"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"},{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2464"},{"id":"ref-for-concept-credential\u2460\u2465"},{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2463"},{"id":"ref-for-concept-credential\u2461\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"},{"id":"ref-for-concept-credential\u2461\u2468"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2462\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2460"},{"id":"ref-for-concept-credential\u2462\u2461"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
+"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"},{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2464"},{"id":"ref-for-concept-credential\u2460\u2465"},{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2463"},{"id":"ref-for-concept-credential\u2461\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"},{"id":"ref-for-concept-credential\u2461\u2468"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2462\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2460"},{"id":"ref-for-concept-credential\u2462\u2461"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2463"},{"id":"ref-for-concept-credential\u2462\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
 "7393da89": {"dfnID":"7393da89","dfnText":"same origin","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-origin"},
 "7482107b": {"dfnID":"7482107b","dfnText":"webdriver error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"},{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"},{"id":"ref-for-dfn-error-code\u2468"},{"id":"ref-for-dfn-error-code\u2460\u24ea"},{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"},{"id":"ref-for-dfn-error-code\u2460\u2462"},{"id":"ref-for-dfn-error-code\u2460\u2463"},{"id":"ref-for-dfn-error-code\u2460\u2464"},{"id":"ref-for-dfn-error-code\u2460\u2465"},{"id":"ref-for-dfn-error-code\u2460\u2466"},{"id":"ref-for-dfn-error-code\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u24ea"},{"id":"ref-for-dfn-error-code\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2462"},{"id":"ref-for-dfn-error-code\u2461\u2463"},{"id":"ref-for-dfn-error-code\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2465"},{"id":"ref-for-dfn-error-code\u2461\u2466"},{"id":"ref-for-dfn-error-code\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
 "7787d359": {"dfnID":"7787d359","dfnText":"record","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-record"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-record\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-record"},
@@ -11284,10 +11286,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authdata-signcount": {"dfnID":"authdata-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-signcount"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-signcount\u2460"},{"id":"ref-for-authdata-signcount\u2461"},{"id":"ref-for-authdata-signcount\u2462"},{"id":"ref-for-authdata-signcount\u2463"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authdata-signcount\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-signcount\u2465"},{"id":"ref-for-authdata-signcount\u2466"},{"id":"ref-for-authdata-signcount\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-signcount"},
 "authentication": {"dfnID":"authentication","dfnText":"Authentication","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication"},{"id":"ref-for-authentication\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authentication\u2462"},{"id":"ref-for-authentication\u2463"},{"id":"ref-for-authentication\u2464"},{"id":"ref-for-authentication\u2465"},{"id":"ref-for-authentication\u2466"},{"id":"ref-for-authentication\u2467"},{"id":"ref-for-authentication\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authentication\u2460\u2460"},{"id":"ref-for-authentication\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication\u2460\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authentication\u2460\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authentication\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authentication\u2460\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication\u2460\u2468"}],"title":"16. Acknowledgements"}],"url":"#authentication"},
 "authentication-assertion": {"dfnID":"authentication-assertion","dfnText":"Authentication Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-assertion"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication-assertion\u2460"},{"id":"ref-for-authentication-assertion\u2461"},{"id":"ref-for-authentication-assertion\u2462"},{"id":"ref-for-authentication-assertion\u2463"},{"id":"ref-for-authentication-assertion\u2464"},{"id":"ref-for-authentication-assertion\u2465"},{"id":"ref-for-authentication-assertion\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-assertion\u2467"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-assertion\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2464"},{"id":"ref-for-authentication-assertion\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#authentication-assertion"},
-"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2466"},{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"},{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2461"},{"id":"ref-for-authentication-ceremony\u2464\u2462"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
+"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"},{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"},{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2462"},{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
 "authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2460"},{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"},{"id":"ref-for-authentication-extension\u2460\u2467"},{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u24ea"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2460"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
 "authentication-factor-capability": {"dfnID":"authentication-factor-capability","dfnText":"Authentication Factor Capability","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-factor-capability"},{"id":"ref-for-authentication-factor-capability\u2460"},{"id":"ref-for-authentication-factor-capability\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authentication-factor-capability"},
-"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2462"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2464"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u24ea"},{"id":"ref-for-authenticator\u2462\u2463\u2460"},{"id":"ref-for-authenticator\u2462\u2463\u2461"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2462"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
+"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2462"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2464"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u24ea"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2460"},{"id":"ref-for-authenticator\u2462\u2463\u2461"},{"id":"ref-for-authenticator\u2462\u2463\u2462"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2463"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
 "authenticator-attachment-modality": {"dfnID":"authenticator-attachment-modality","dfnText":"Authenticator Attachment Modality","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-attachment-modality"},{"id":"ref-for-authenticator-attachment-modality\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2465"},{"id":"ref-for-authenticator-attachment-modality\u2466"},{"id":"ref-for-authenticator-attachment-modality\u2467"},{"id":"ref-for-authenticator-attachment-modality\u2468"},{"id":"ref-for-authenticator-attachment-modality\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2460\u2460"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-attachment-modality"},
 "authenticator-configuration": {"dfnID":"authenticator-configuration","dfnText":"Authenticator Configuration","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-configuration"},{"id":"ref-for-authenticator-configuration\u2460"},{"id":"ref-for-authenticator-configuration\u2461"},{"id":"ref-for-authenticator-configuration\u2462"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticator-configuration"},
 "authenticator-credentials-map": {"dfnID":"authenticator-credentials-map","dfnText":"credentials map","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-credentials-map"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2461"},{"id":"ref-for-authenticator-credentials-map\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2463"},{"id":"ref-for-authenticator-credentials-map\u2464"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2465"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2466"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460\u24ea"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#authenticator-credentials-map"},
@@ -11360,7 +11362,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "cece9985": {"dfnID":"cece9985","dfnText":"kty","external":true,"refSections":[{"refs":[{"id":"ref-for-name-cose-key-common-parameters"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
 "ceremony": {"dfnID":"ceremony","dfnText":"Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-ceremony"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-ceremony\u2460"},{"id":"ref-for-ceremony\u2461"},{"id":"ref-for-ceremony\u2462"},{"id":"ref-for-ceremony\u2463"},{"id":"ref-for-ceremony\u2464"},{"id":"ref-for-ceremony\u2465"},{"id":"ref-for-ceremony\u2466"},{"id":"ref-for-ceremony\u2467"},{"id":"ref-for-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ceremony\u2460\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-ceremony\u2460\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2465"},{"id":"ref-for-ceremony\u2460\u2466"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-ceremony\u2460\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#ceremony"},
 "cfc67fdc": {"dfnID":"cfc67fdc","dfnText":"empty host","external":true,"refSections":[{"refs":[{"id":"ref-for-empty-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-empty-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#empty-host"},
-"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-client\u2463\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client\u2463\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client\u2463\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"},{"id":"ref-for-client\u2463\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2463"},{"id":"ref-for-client\u2464\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2465"},{"id":"ref-for-client\u2464\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2467"},{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2461"},{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u2464"},{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"},{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"},{"id":"ref-for-client\u2466\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2466\u2460"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2466\u2462"},{"id":"ref-for-client\u2466\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u2464"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2466"},{"id":"ref-for-client\u2466\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2466\u2468"},{"id":"ref-for-client\u2467\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2467\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2467\u2461"},{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2467"},{"id":"ref-for-client\u2467\u2468"},{"id":"ref-for-client\u2468\u24ea"},{"id":"ref-for-client\u2468\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2468\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2468\u2462"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2468\u2466"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"},{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"},{"id":"ref-for-client\u2460\u24ea\u2463"},{"id":"ref-for-client\u2460\u24ea\u2464"},{"id":"ref-for-client\u2460\u24ea\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"},{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"},{"id":"ref-for-client\u2460\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2466"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"},{"id":"ref-for-client\u2460\u2461\u24ea"},{"id":"ref-for-client\u2460\u2461\u2460"},{"id":"ref-for-client\u2460\u2461\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2462"},{"id":"ref-for-client\u2460\u2461\u2463"},{"id":"ref-for-client\u2460\u2461\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2466"},{"id":"ref-for-client\u2460\u2461\u2467"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2468"}],"title":"14.5. Privacy considerations for clients"}],"url":"#client"},
+"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-client\u2463\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client\u2463\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client\u2463\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"},{"id":"ref-for-client\u2463\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2463"},{"id":"ref-for-client\u2464\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2465"},{"id":"ref-for-client\u2464\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2467"},{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2461"},{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u2464"},{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"},{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"},{"id":"ref-for-client\u2466\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2466\u2460"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2466\u2462"},{"id":"ref-for-client\u2466\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u2464"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2466"},{"id":"ref-for-client\u2466\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2466\u2468"},{"id":"ref-for-client\u2467\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2467\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2467\u2461"},{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2467"},{"id":"ref-for-client\u2467\u2468"},{"id":"ref-for-client\u2468\u24ea"},{"id":"ref-for-client\u2468\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2468\u2461"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2468\u2462"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2468\u2466"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"},{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"},{"id":"ref-for-client\u2460\u24ea\u2463"},{"id":"ref-for-client\u2460\u24ea\u2464"},{"id":"ref-for-client\u2460\u24ea\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"},{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"},{"id":"ref-for-client\u2460\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2466"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"},{"id":"ref-for-client\u2460\u2461\u24ea"},{"id":"ref-for-client\u2460\u2461\u2460"},{"id":"ref-for-client\u2460\u2461\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2462"},{"id":"ref-for-client\u2460\u2461\u2463"},{"id":"ref-for-client\u2460\u2461\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2466"},{"id":"ref-for-client\u2460\u2461\u2467"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2468"}],"title":"14.5. Privacy considerations for clients"},{"refs":[{"id":"ref-for-client\u2460\u2462\u24ea"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#client"},
 "client-data": {"dfnID":"client-data","dfnText":"client data","external":false,"refSections":[{"refs":[{"id":"ref-for-client-data"},{"id":"ref-for-client-data\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-client-data\u2461"},{"id":"ref-for-client-data\u2462"},{"id":"ref-for-client-data\u2463"},{"id":"ref-for-client-data\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-data\u2465"},{"id":"ref-for-client-data\u2466"},{"id":"ref-for-client-data\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-data\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-data\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-data\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2461"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-data\u2460\u2463"},{"id":"ref-for-client-data\u2460\u2464"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#client-data"},
 "client-device": {"dfnID":"client-device","dfnText":"Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-client-device"},{"id":"ref-for-client-device\u2460"},{"id":"ref-for-client-device\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-client-device\u2462"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-device\u2463"},{"id":"ref-for-client-device\u2464"},{"id":"ref-for-client-device\u2465"},{"id":"ref-for-client-device\u2466"},{"id":"ref-for-client-device\u2467"},{"id":"ref-for-client-device\u2468"},{"id":"ref-for-client-device\u2460\u24ea"},{"id":"ref-for-client-device\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-device\u2460\u2461"},{"id":"ref-for-client-device\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2463"},{"id":"ref-for-client-device\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2465"},{"id":"ref-for-client-device\u2460\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client-device\u2460\u2467"},{"id":"ref-for-client-device\u2460\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client-device\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-client-device\u2461\u2460"},{"id":"ref-for-client-device\u2461\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-device\u2461\u2462"},{"id":"ref-for-client-device\u2461\u2463"},{"id":"ref-for-client-device\u2461\u2464"},{"id":"ref-for-client-device\u2461\u2465"},{"id":"ref-for-client-device\u2461\u2466"},{"id":"ref-for-client-device\u2461\u2467"},{"id":"ref-for-client-device\u2461\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-device\u2462\u24ea"},{"id":"ref-for-client-device\u2462\u2460"},{"id":"ref-for-client-device\u2462\u2461"},{"id":"ref-for-client-device\u2462\u2462"},{"id":"ref-for-client-device\u2462\u2463"},{"id":"ref-for-client-device\u2462\u2464"},{"id":"ref-for-client-device\u2462\u2465"},{"id":"ref-for-client-device\u2462\u2466"},{"id":"ref-for-client-device\u2462\u2467"},{"id":"ref-for-client-device\u2462\u2468"},{"id":"ref-for-client-device\u2463\u24ea"},{"id":"ref-for-client-device\u2463\u2460"},{"id":"ref-for-client-device\u2463\u2461"},{"id":"ref-for-client-device\u2463\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2464"},{"id":"ref-for-client-device\u2463\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-client-device\u2463\u2466"},{"id":"ref-for-client-device\u2463\u2467"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#client-device"},
 "client-extension": {"dfnID":"client-extension","dfnText":"client extension","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension\u2466"}],"title":"10.1. Client Extensions"},{"refs":[{"id":"ref-for-client-extension\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-extension\u2468"},{"id":"ref-for-client-extension\u2460\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-client-extension\u2460\u2462"},{"id":"ref-for-client-extension\u2460\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#client-extension"},
@@ -11377,7 +11379,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "concept-user-present": {"dfnID":"concept-user-present","dfnText":"User Present","external":false,"refSections":[{"refs":[{"id":"ref-for-concept-user-present"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-user-present\u2460"},{"id":"ref-for-concept-user-present\u2461"},{"id":"ref-for-concept-user-present\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-concept-user-present\u2463"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"#concept-user-present"},
 "concept-user-verified": {"dfnID":"concept-user-verified","dfnText":"User Verified","external":false,"refSections":[{"refs":[{"id":"ref-for-concept-user-verified"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-user-verified\u2460"},{"id":"ref-for-concept-user-verified\u2461"},{"id":"ref-for-concept-user-verified\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-concept-user-verified\u2463"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#concept-user-verified"},
 "conforming-user-agent": {"dfnID":"conforming-user-agent","dfnText":"Conforming User Agent","external":false,"refSections":[{"refs":[{"id":"ref-for-conforming-user-agent"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-conforming-user-agent\u2460"}],"title":"2.1. User Agents"},{"refs":[{"id":"ref-for-conforming-user-agent\u2461"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-conforming-user-agent\u2462"}],"title":"4. Terminology"}],"url":"#conforming-user-agent"},
-"contains": {"dfnID":"contains","dfnText":"contains","external":false,"refSections":[{"refs":[{"id":"ref-for-contains"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-contains\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-contains\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#contains"},
+"contains": {"dfnID":"contains","dfnText":"contains","external":false,"refSections":[{"refs":[{"id":"ref-for-contains"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-contains\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-contains\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-contains\u2462"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#contains"},
 "create-candidate-authenticator": {"dfnID":"create-candidate-authenticator","dfnText":"candidate authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-candidate-authenticator"},{"id":"ref-for-create-candidate-authenticator\u2460"},{"id":"ref-for-create-candidate-authenticator\u2461"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-candidate-authenticator"},
 "create-selected-authenticator": {"dfnID":"create-selected-authenticator","dfnText":"selected authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-create-selected-authenticator"},{"id":"ref-for-create-selected-authenticator\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#create-selected-authenticator"},
 "created-on": {"dfnID":"created-on","dfnText":"created on","external":false,"refSections":[{"refs":[{"id":"ref-for-created-on"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-created-on\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#created-on"},
@@ -11731,7 +11733,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
 "registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
 "registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"},{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
-"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"},{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"},{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2468"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2468"},{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"},{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2465"},{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2462\u2468"},{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"},{"id":"ref-for-relying-party\u2462\u2463\u2465"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2466"},{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2460"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2460"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2463"},{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2460"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2461"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
+"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"},{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"},{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2468"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2468"},{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"},{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2465"},{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2462\u2468"},{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"},{"id":"ref-for-relying-party\u2462\u2463\u2465"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2466"},{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2460"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2461"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2461"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2462"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},
 "remove-all-credentials": {"dfnID":"remove-all-credentials","dfnText":"Remove All Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-all-credentials"}],"title":"11.8. Remove All Credentials"}],"url":"#remove-all-credentials"},
 "remove-credential": {"dfnID":"remove-credential","dfnText":"Remove Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-credential"}],"title":"11.7. Remove Credential"}],"url":"#remove-credential"},
@@ -11770,7 +11772,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "ui-redressing": {"dfnID":"ui-redressing","dfnText":"UI Redressing","external":false,"refSections":[{"refs":[{"id":"ref-for-ui-redressing"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-ui-redressing\u2460"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"}],"url":"#ui-redressing"},
 "unsigned-extension-outputs": {"dfnID":"unsigned-extension-outputs","dfnText":"Unsigned extension outputs","external":false,"refSections":[{"refs":[{"id":"ref-for-unsigned-extension-outputs"},{"id":"ref-for-unsigned-extension-outputs\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2462"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2463"},{"id":"ref-for-unsigned-extension-outputs\u2464"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#unsigned-extension-outputs"},
 "user-account": {"dfnID":"user-account","dfnText":"User Account","external":false,"refSections":[{"refs":[{"id":"ref-for-user-account"},{"id":"ref-for-user-account\u2460"},{"id":"ref-for-user-account\u2461"},{"id":"ref-for-user-account\u2462"},{"id":"ref-for-user-account\u2463"},{"id":"ref-for-user-account\u2464"},{"id":"ref-for-user-account\u2465"},{"id":"ref-for-user-account\u2466"},{"id":"ref-for-user-account\u2467"},{"id":"ref-for-user-account\u2468"},{"id":"ref-for-user-account\u2460\u24ea"},{"id":"ref-for-user-account\u2460\u2460"},{"id":"ref-for-user-account\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-account\u2460\u2462"},{"id":"ref-for-user-account\u2460\u2463"},{"id":"ref-for-user-account\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-user-account\u2460\u2465"},{"id":"ref-for-user-account\u2460\u2466"},{"id":"ref-for-user-account\u2460\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-user-account\u2460\u2468"},{"id":"ref-for-user-account\u2461\u24ea"},{"id":"ref-for-user-account\u2461\u2460"},{"id":"ref-for-user-account\u2461\u2461"},{"id":"ref-for-user-account\u2461\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-account\u2461\u2463"},{"id":"ref-for-user-account\u2461\u2464"},{"id":"ref-for-user-account\u2461\u2465"},{"id":"ref-for-user-account\u2461\u2466"},{"id":"ref-for-user-account\u2461\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-account\u2461\u2468"},{"id":"ref-for-user-account\u2462\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-user-account\u2462\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-account\u2462\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-account\u2462\u2462"},{"id":"ref-for-user-account\u2462\u2463"},{"id":"ref-for-user-account\u2462\u2464"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-account\u2462\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-user-account\u2462\u2466"},{"id":"ref-for-user-account\u2462\u2467"},{"id":"ref-for-user-account\u2462\u2468"},{"id":"ref-for-user-account\u2463\u24ea"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-user-account\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-account\u2463\u2461"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-account\u2463\u2462"},{"id":"ref-for-user-account\u2463\u2463"}],"title":"14.6.2. Username Enumeration"}],"url":"#user-account"},
-"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"},{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"},{"id":"ref-for-user-consent\u2460\u2462"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-user-consent\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2465"},{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2468"},{"id":"ref-for-user-consent\u2461\u24ea"},{"id":"ref-for-user-consent\u2461\u2460"},{"id":"ref-for-user-consent\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2462"},{"id":"ref-for-user-consent\u2461\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2464"},{"id":"ref-for-user-consent\u2461\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"},{"id":"ref-for-user-consent\u2461\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2468"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2462\u2461"},{"id":"ref-for-user-consent\u2462\u2462"},{"id":"ref-for-user-consent\u2462\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
+"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"},{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2463"},{"id":"ref-for-user-consent\u2460\u2464"},{"id":"ref-for-user-consent\u2460\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"},{"id":"ref-for-user-consent\u2460\u2468"},{"id":"ref-for-user-consent\u2461\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2460"},{"id":"ref-for-user-consent\u2461\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2462"},{"id":"ref-for-user-consent\u2461\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2464"},{"id":"ref-for-user-consent\u2461\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2461\u2467"},{"id":"ref-for-user-consent\u2461\u2468"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
 "user-credential": {"dfnID":"user-credential","dfnText":"User Credential","external":false,"refSections":[],"url":"#user-credential"},
 "user-handle": {"dfnID":"user-handle","dfnText":"User Handle","external":false,"refSections":[{"refs":[{"id":"ref-for-user-handle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-user-handle\u2460"},{"id":"ref-for-user-handle\u2461"},{"id":"ref-for-user-handle\u2462"},{"id":"ref-for-user-handle\u2463"},{"id":"ref-for-user-handle\u2464"},{"id":"ref-for-user-handle\u2465"},{"id":"ref-for-user-handle\u2466"},{"id":"ref-for-user-handle\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-handle\u2468"},{"id":"ref-for-user-handle\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-handle\u2460\u2460"},{"id":"ref-for-user-handle\u2460\u2461"},{"id":"ref-for-user-handle\u2460\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-handle\u2460\u2463"},{"id":"ref-for-user-handle\u2460\u2464"},{"id":"ref-for-user-handle\u2460\u2465"},{"id":"ref-for-user-handle\u2460\u2466"},{"id":"ref-for-user-handle\u2460\u2467"},{"id":"ref-for-user-handle\u2460\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-handle\u2461\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-handle\u2461\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-handle\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-handle\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-handle\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-handle\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-handle\u2461\u2467"},{"id":"ref-for-user-handle\u2461\u2468"},{"id":"ref-for-user-handle\u2462\u24ea"},{"id":"ref-for-user-handle\u2462\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"#user-handle"},
 "user-public-key": {"dfnID":"user-public-key","dfnText":"User Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-user-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-public-key\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#user-public-key"},