From 845875d8473feaee681dd902f94141544a4bc076 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Wed, 13 Nov 2024 20:34:50 +0000
Subject: [PATCH] Merge pull request #2194 from
 w3c/issue-2187-drop-credentialRecord-authenticatorDisplayName

SHA: fd53e2c3d890118f7dd022a143927b815073f441
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 1208 +++++++++++++++++++++++++---------------------------
 1 file changed, 579 insertions(+), 629 deletions(-)

diff --git a/index.html b/index.html
index a252e4ed9..907d7d649 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 742f3d674, updated Mon Nov 4 14:56:54 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="0633494704a6319cdfd7b03fb8ff782e01e5b481" name="revision">
+  <meta content="fd53e2c3d890118f7dd022a143927b815073f441" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -2208,36 +2208,29 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The value of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson">clientDataJSON</a></code> attribute
 when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②④">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①②">registered</a>.
 Storing this in combination with the above <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject">attestationObject</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item②">item</a> enables the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤③">Relying Party</a> to re-verify the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①">attestation signature</a> at a later time.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</dfn>
-      <dd data-md>
-       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> description of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>.</p>
-       <p>If used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Party</a> SHOULD use this to describe the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a> in the user’s account settings.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> SHOULD allow the user to choose this value, and MAY allow the user to modify it at will.</p>
-       <p>The <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> defines the <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential property</a> <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname">authenticatorDisplayName</a></code> which, when available, MAY be offered as a default for this value.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a> MAY alternatively derive a default value from the authenticator’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a>, if any.</p>
      </dl>
-     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
+     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
 and MAY omit any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑤">items</a> not needed for their implementation.</p>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-descriptor-for-a-credential-record">credential descriptor for a credential record</dfn> is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a></code> value with the contents:</p>
      <dl>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type">type</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id">id</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①">transports</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
      </dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="generating-authenticator">Generating Authenticator</dfn>
     <dd data-md>
      <p>The Generating Authenticator is the authenticator involved in the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①">authenticatorMakeCredential</a> operation resulting
-in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the
+in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the
 current <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑧">managing authenticator</a> participating in a given <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑤">authentication</a> operation.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="human palatability|human-palatable" data-noexport id="human-palatability">Human Palatability</dfn>
     <dd data-md>
-     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> is intended to be rememberable and reproducible by typical human
+     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> is intended to be rememberable and reproducible by typical human
 users, in contrast to identifiers that are, for example, randomly generated sequences of bits <a data-link-type="biblio" href="#biblio-edupersonobjectclassspec" title="EduPerson">[EduPersonObjectClassSpec]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-discoverable-credential">Non-Discoverable Credential</dfn>
     <dd data-md>
@@ -2249,8 +2242,8 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 For example, the <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label">registrable origin label</a> of both <code>example.co.uk</code> and <code>www.example.de</code> is <code>example</code> if both <code>co.uk</code> and <code>de</code> are <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-public-suffix" id="ref-for-host-public-suffix">public suffixes</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential">Public Key Credential</dfn>
     <dd data-md>
-     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, the
-possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
+     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>, the
+possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
      <div class="note" role="note">
        Note: This is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#willful-violation" id="ref-for-willful-violation">willful violation</a> of <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. In English, a "credential" is both a) the thing presented to prove
     a statement and b) intended to be used multiple times. It’s impossible to achieve both criteria securely with a single
@@ -2260,7 +2253,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
       <dl>
        <dt data-md>"Authentication information" (possibly including a private key)
        <dd data-md>
-        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">Public key credential source</a></p>
+        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">Public key credential source</a></p>
        <dt data-md>"Signed value"
        <dd data-md>
         <p><a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion④">Authentication assertion</a></p>
@@ -2269,12 +2262,12 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
         <p><a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑧">Credential public key</a> or <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②">attestation object</a></p>
       </dl>
      </div>
-     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
-Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a> uses its stored
+     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
+Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a> uses its stored
 copy of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⓪">credential public key</a> to verify the resultant <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑤">authentication assertion</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential-source">Public Key Credential Source</dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
+     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-type">type</dfn>
       <dd data-md>
@@ -2287,20 +2280,20 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key④">credential private key</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-rpid">rpId</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
+       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
 This is determined by the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id">id</a></code></code> parameter of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①">create()</a></code> operation.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-userhandle">userHandle</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
+       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
 nullable, however <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②">user handle</a> MUST always be populated for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②">discoverable credentials</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-otherui">otherUI</dfn>
       <dd data-md>
-       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
+       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
      </dl>
-     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
+     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
 credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-managing-authenticator">managing authenticator</dfn> and returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①①">credential public key</a> associated with its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑤">credential
-private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
-this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a>.</p>
+private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
+this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rate-limiting">Rate Limiting</dfn>
     <dd data-md>
      <p>The process (also known as throttling) by which an authenticator implements controls against brute force attacks by limiting
@@ -2311,25 +2304,25 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration">Registration</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration-ceremony">Registration Ceremony</dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
+     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
 Note that this includes employing a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence②">test of user presence</a> or <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑦">user verification</a>.
 After a successful <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②">registration ceremony</a>, the user can be authenticated by an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥">authentication ceremony</a>.</p>
      <p>The WebAuthn <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③">registration ceremony</a> is defined in <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
+and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
 with a <code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey">publicKey</a></code> argument.
 See <a href="#sctn-api">§ 5 Web Authentication API</a> for an introductory overview and <a href="#sctn-sample-registration">§ 1.3.1 Registration</a> for implementation examples.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party">Relying Party</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-relying-party">WebAuthn Relying Party</dfn>
     <dd data-md>
      <p>The entity whose <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-application">web application</dfn> utilizes the <a href="#sctn-api">Web Authentication API</a> to <a data-link-type="dfn" href="#registration" id="ref-for-registration①④">register</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑦">authenticate</a> users.</p>
-     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> implementation typically consists of both some client-side script
+     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> implementation typically consists of both some client-side script
 that invokes the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑦">Web Authentication API</a> in the <a data-link-type="dfn" href="#client" id="ref-for-client①④">client</a>,
 and a server-side component that executes the <a href="#sctn-rp-operations">Relying Party operations</a> and other application logic.
 Communication between the two components MUST use HTTPS or equivalent transport security,
 but is otherwise beyond the scope of this specification.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> in one
-    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
-    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
+     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> in one
+    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
+    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
     a WebAuthn context may be embedded in a broader overall context, e.g., one based on OAuth.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party-identifier">Relying Party Identifier</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rp-id">RP ID</dfn>
@@ -2355,7 +2348,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <li data-md>
         <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port②">port</a> is unrestricted.</p>
       </ul>
-      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>. Another example of a valid origin is <code>http://localhost:8000</code>, due to the origin being <code>localhost</code>.</p>
+      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>. Another example of a valid origin is <code>http://localhost:8000</code>, due to the origin being <code>localhost</code>.</p>
       <p>This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, <a data-link-type="biblio" href="#biblio-rfc6265" title="HTTP State Management Mechanism">[RFC6265]</a>).
     Please note that this is a greater relaxation of "same-origin" restrictions than what <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain" id="ref-for-dom-document-domain">document.domain</a>'s setter provides.</p>
       <p>These restrictions on origin values apply to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑤">WebAuthn Clients</a>.</p>
@@ -2369,10 +2362,10 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 For backwards compatibility purposes, the various <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⓪">WebAuthn API</a> and <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model①">Authenticator Model</a> components
 with various forms of <code>resident</code> within their names have not been changed.</p>
      <p>A <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source①">Server-side Public Key Credential Source</a>, or <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential④">Server-side Credential</a> for short,
-is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> must
+is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> must
 manage the credential’s storage and discovery, as well as be able to first identify the user in order to
 discover the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①④">credential IDs</a> to supply in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑦">navigator.credentials.get()</a></code> call.</p>
-     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
+     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
 This is in contrast to a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑤">client-side discoverable credential</a>,
 which instead does not require the user to first be identified in order to provide the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑤">credential ID</a>s
 to a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑧">navigator.credentials.get()</a></code> call.</p>
@@ -2387,27 +2380,27 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-account">User Account</dfn>
     <dd data-md>
      <p>In the context of this specification,
-a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
+a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
 This mapping, the set of credentials, and their authorizations, may evolve over time.
 A given <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑦">user account</a> might be accessed by one or more natural persons (also known as "users"),
 and one natural person might have access to one or more <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑧">user accounts</a>,
-depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>.</p>
+depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-consent">User Consent</dfn>
     <dd data-md>
      <p>User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts.
 An <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①①">authorization gesture</a> is a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑨">ceremony</a> component often employed to indicate <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent④">user consent</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-handle">User Handle</dfn>
     <dd data-md>
-     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
+     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
      <p>The main use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle④">user handle</a> is to identify the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⓪">user account</a> in such <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑨">authentication ceremonies</a>,
 but the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑥">credential ID</a> could be used instead.
 The main differences are
 that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">authenticator</a> and is unique for each credential,
-while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> and ought to be the same
+while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> and ought to be the same
 for all <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑤">credentials</a> registered to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①①">user account</a>.</p>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential sources</a>.
-As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a>. Therefore
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential sources</a>.
+As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>. Therefore
 a secondary use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑧">user handle</a> is to allow <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑥">authenticators</a> to know when to replace an existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credential</a> with a new one during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration ceremony</a>.</p>
      <p>A user handle is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence①">byte sequence</a> with a maximum size of 64 bytes, and is not meant to be displayed to the user.
 It MUST NOT contain personally identifying information, see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
@@ -2421,7 +2414,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 through various <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①②">authorization gesture</a> modalities; for example, through a touch plus pin code, password entry, or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition②">biometric recognition</a> (e.g., presenting a fingerprint) <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>. The intent is to
 distinguish individual users.
 See also <a href="#sctn-authentication-factor-capability">§ 6.2.3 Authentication Factor Capability</a>.</p>
-     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a> a concrete identification of the user,
+     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a> a concrete identification of the user,
 but when 2 or more ceremonies with <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①①">user verification</a> have been done with that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑥">credential</a> it expresses that it was the same user that performed all of them.
 The same user might not always be the same natural person, however,
 if multiple natural persons share access to the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑧">authenticator</a>.</p>
@@ -2442,8 +2435,8 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
    </dl>
    <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-authentication-api">Web Authentication API</dfn></span><a class="self-link" href="#sctn-api"></a></h2>
    <p>This section normatively specifies the API for creating and using <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⓪">public key credentials</a>. The basic
-idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
-browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
+idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
+browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
    <figure id="fig-registration">
      <img src="images/webauthn-registration-flow-01.svg"> 
     <figcaption>Registration Flow</figcaption>
@@ -2467,12 +2460,12 @@ <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5.
 a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin④">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
 the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
 is created as well as in all assertions produced by WebAuthn credentials.</p>
-   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
-credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
-Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Party</a> can only be used in operations
+   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
+credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
+Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a> can only be used in operations
 requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
-where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origins</a>.</p>
-   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
+where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origins</a>.</p>
+   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
 each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context">secure contexts</a>.
 For web contexts in particular,
 this only includes those accessed via a secure transport (e.g., TLS) established without errors.</p>
@@ -2508,11 +2501,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②">DOMString</a>, readonly, nullable</span>
     <dd data-md>
      <p>This attribute reports the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality">authenticator attachment modality</a> in effect at the time the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⓪">navigator.credentials.get()</a></code> methods successfully complete.
-The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Parties</a> SHOULD treat unknown values
+The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Parties</a> SHOULD treat unknown values
 as if the value were null.</p>
      <div class="note" role="note">
        Note: If, as the result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⓪">authentication ceremony</a>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment①">authenticatorAttachment</a></code>'s value is "cross-platform" and
-concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
+concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
       <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①">attachment modality</a> could change over time.
 For example, a mobile phone might at one time only support <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment">platform attachment</a> but later receive updates to support <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment">cross-platform attachment</a> as well.</p>
      </div>
@@ -2534,7 +2527,7 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson">toJSON()</a></code>
     <dd data-md>
      <p>This operation returns <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson">RegistrationResponseJSON</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson">AuthenticationResponseJSON</a></code>,
-which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
+which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
 but MUST take additional steps to first encode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②">ArrayBuffer</a></code> values to <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③">DOMString</a></code> values
 using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①">base64url encoding</a>.</p>
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-registrationresponsejson-clientextensionresults" id="ref-for-dom-registrationresponsejson-clientextensionresults">RegistrationResponseJSON.clientExtensionResults</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationresponsejson-clientextensionresults" id="ref-for-dom-authenticationresponsejson-clientextensionresults">AuthenticationResponseJSON.clientExtensionResults</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults①">getClientExtensionResults()</a></code>,
@@ -2615,7 +2608,7 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 For example, an authenticator without on-board storage may create identifiers containing a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑦">credential private key</a> wrapped with a symmetric key that is burned into the authenticator.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-clientextensionsresults-slot"><code>[[clientExtensionsResults]]</code></dfn>
     <dd data-md>
-     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑥">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get()</a></code>.</p>
+     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑥">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get()</a></code>.</p>
    </dl>
    <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⓪">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object②">interface object</a> inherits <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑥">Credential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, and defines its own
 implementation of each of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-store-slot" id="ref-for-dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a></code>.</p>
@@ -2636,9 +2629,9 @@ <h4 class="heading settled" data-level="5.1.2" id="sctn-credentialrequestoptions
 </pre>
    <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span class="secno">5.1.3. </span><span class="content">Create a New Credential - PublicKeyCredential’s <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-create-slot"><code>[[Create]](origin, options, sameOriginWithAncestors)</code></dfn> Internal Method</span><a class="self-link" href="#sctn-createCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)">
-     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>. 
-    <p>By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Parties</a> can indicate that they would like to register a credential without prominent modal UI if the user has already consented to create a credential.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities①">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate①">conditionalCreate</a></code> capability
+     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>. 
+    <p>By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Parties</a> can indicate that they would like to register a credential without prominent modal UI if the user has already consented to create a credential.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities①">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalcreate" id="ref-for-dom-clientcapability-conditionalcreate①">conditionalCreate</a></code> capability
 in order to prevent a user-visible error in case this feature is not available.
 The client MUST set BOTH <var>requireUserPresence</var> and <var>requireUserVerification</var> to <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation①">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑥">conditional</a></code> unless they may explicitly performed during the ceremony.</p>
     <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑨">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
@@ -2987,11 +2980,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <p>Throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
         </ol>
         <p class="note" role="note"><span class="marker">Note:</span> This error status is handled separately because the <var>authenticator</var> returns it only if <var>excludeCredentialDescriptorList</var> identifies a credential <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑨">bound</a> to the <var>authenticator</var> and the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑥">consented</a> to the operation. Given this explicit consent, it is acceptable for this case to be
-distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a>.</p>
+distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a>.</p>
        <dt data-md>If any <var>authenticator</var> returns an error status not equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>",
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑧">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
+        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
 details.</p>
        <dt data-md>If any <var>authenticator</var> indicates success,
        <dd data-md>
@@ -3039,11 +3032,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
               </ol>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect">indirect</a></code>
              <dd data-md>
-              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a> with a more privacy-friendly
+              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a> with a more privacy-friendly
 and/or more easily verifiable version of the same data (for example, by employing an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca">Anonymization CA</a>).</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-direct" id="ref-for-dom-attestationconveyancepreference-direct">direct</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise①">enterprise</a></code>
              <dd data-md>
-              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a>.</p>
+              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a>.</p>
             </dl>
            <li data-md>
             <p>Let <var>attestationObject</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑤">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor①">%ArrayBuffer%</a>, containing the
@@ -3072,7 +3065,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-transports-slot" id="ref-for-dom-authenticatorattestationresponse-transports-slot">[[transports]]</a></code>
                <dd data-md>
                 <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
-                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Party</a> behavior may be suboptimal.</p>
+                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> behavior may be suboptimal.</p>
                 <p>If the user agent does not have any transport information, it SHOULD set this field to the empty sequence.</p>
                 <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform authenticator</a>.</p>
               </dl>
@@ -3142,17 +3135,17 @@ <h5 class="heading settled" data-level="5.1.3.1" id="sctn-create-request-excepti
    </dl>
    <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> script optionally specifies some criteria
-to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
-decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a> script optionally specifies some criteria
+to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
+decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
 should be available without <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated③">user mediation</a> (roughly, this specification’s <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①③">authorization gesture</a>), and if it does not find
 exactly one of those, it then calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code></code> to have
-the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a>.</p>
+the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>.</p>
    <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertions</a>, <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①④">PublicKeyCredential</a></code> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot①">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, of returning an empty set. <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑤">PublicKeyCredential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> is specified in the next section.</p>
    <p>In general, the user agent SHOULD show some UI to the user to guide them in selecting and authorizing an authenticator with which
-to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities②">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget①">conditionalGet</a></code> capability
+to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities②">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget①">conditionalGet</a></code> capability
 in order to prevent a user-visible error in case this feature is not available.</p>
    <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
@@ -3579,9 +3572,9 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
       <dd data-md>
        <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑥">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>userVerification</var>,
 and <var>authenticatorExtensions</var> as parameters.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
+       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
     authenticator is being asked to exercise any credential it may possess that is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑨">scoped</a> to
-    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a>, as identified by <var>rpId</var>.</p>
+    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a>, as identified by <var>rpId</var>.</p>
      </dl>
     <li data-md>
      <p>Return <code>true</code>.</p>
@@ -3646,7 +3639,7 @@ <h4 class="heading settled" data-level="5.1.6" id="sctn-isUserVerifyingPlatformA
 Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
 If any are discovered, the promise is resolved with the value of <code>true</code>.
 Otherwise, the promise is resolved with the value of <code>false</code>.
-Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> can take further actions to guide the user to create a credential.</p>
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> can take further actions to guide the user to create a credential.</p>
     <p>This method has no arguments and returns a Boolean value.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑨"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
@@ -3671,8 +3664,8 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><
     <p>When the value for a given capability is <code>true</code>, the feature is known to be currently supported by the client.
 When the value for a given capability is <code>false</code>, the feature is known to be not currently supported by the client.
 When a capability does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exist</a> as a key, the availability of the client feature is not known.</p>
-    <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
-    <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
+    <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
     <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
@@ -3843,7 +3836,7 @@ <h5 class="heading settled" data-level="5.1.10.2" id="sctn-signalUnknownCredenti
    <p>The <dfn class="dfn-paneled" data-dfn-for="signal method/authenticator action" data-dfn-type="dfn" data-noexport id="signal-method-authenticator-action-unknowncredentialid">unknownCredentialId</dfn> <a data-link-type="dfn" href="#signal-method-authenticator-actions" id="ref-for-signal-method-authenticator-actions⑤">authenticator action</a> takes an <code class="idl"><a data-link-type="idl" href="#dictdef-unknowncredentialoptions" id="ref-for-dictdef-unknowncredentialoptions①">UnknownCredentialOptions</a></code> <var>options</var> and is as follows:</p>
    <ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a> <var>credential</var> in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>'s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credential map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a> <var>credential</var> in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>'s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credential map</a>:</p>
      <ol>
       <li data-md>
        <p>If the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> equals <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-rpid" id="ref-for-dom-unknowncredentialoptions-rpid①">rpId</a></code></code> and the <var>credential</var>’s <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> equals the result of <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①①"> base64url decoding</a> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-unknowncredentialoptions-credentialid" id="ref-for-dom-unknowncredentialoptions-credentialid①">credentialId</a></code></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-remove" id="ref-for-map-remove">remove</a> <var>credential</var> from the <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map③">credentials map</a> or employ an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>-specific procedure to hide it from future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremonies</a>.</p>
@@ -3929,9 +3922,9 @@ <h5 class="heading settled" data-level="5.1.10.3" id="sctn-signalAllAcceptedCred
 Therefore, <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Parties</a> may choose to run <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials④">signalAllAcceptedCredentials(options)</a></code> periodically,
 e.g. on every sign in.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Credentials not present in <code class="idl"><a data-link-type="idl" href="#dom-allacceptedcredentialsoptions-allacceptedcredentialids" id="ref-for-dom-allacceptedcredentialsoptions-allacceptedcredentialids②">allAcceptedCredentialIds</a></code> will be removed or
-hidden, potentially irreversibly. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying parties</a> must exercise care that
+hidden, potentially irreversibly. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying parties</a> must exercise care that
 valid credential IDs are never omitted from the list. If a valid <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential
-ID</a> were accidentally omitted, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">relying party</a> should immediately include
+ID</a> were accidentally omitted, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">relying party</a> should immediately include
 it in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑤">signalAllAcceptedCredentials(options)</a></code> as soon as
 possible to "unhide" it, if supported by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">Authenticators</a> should prefer hiding <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">public key credentials</a> for a period of time instead
@@ -3986,7 +3979,7 @@ <h5 class="heading settled" data-level="5.1.10.4" id="sctn-signalCurrentUserDeta
 Therefore, <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Parties</a> may choose to run <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalcurrentuserdetails" id="ref-for-dom-publickeycredential-signalcurrentuserdetails④">signalCurrentUserDetails(options)</a></code> periodically, e.g. on
 every sign in.</p>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①④"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
@@ -4024,9 +4017,9 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-attestationobject"><code>attestationObject</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑨">ArrayBuffer</a>, readonly</span>
      <dd data-md>
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
-tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation
+tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation
 statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑧">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
@@ -4042,13 +4035,13 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⓪">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
    <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
@@ -4059,8 +4052,8 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
      <p>-8 (EdDSA), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves" id="ref-for-name-double-coordinate-curves①">crv</a> is 6 (Ed25519).</p>
    </ul>
    <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm②">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑥">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
-   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
+   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a>'s response to a client’s request for
 generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
@@ -4134,7 +4127,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></span>
      <dd data-md>
-      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> responsible for the request.</p>
+      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a> responsible for the request.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a> the credential
@@ -4144,7 +4137,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
      <dd data-md>
       <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication ceremonies</a></p>
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
@@ -4153,11 +4146,11 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
-      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> supports,
+      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> supports,
 ordered from most preferred to least preferred.
 The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
 If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation fails.</p>
-      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code> values:</p>
+      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code> values:</p>
       <ul>
        <li data-md>
         <p>-8 (Ed25519)</p>
@@ -4169,17 +4162,17 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>Additional signature algorithms can be included as needed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
-      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> is willing to wait for the call to complete. This is
+      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> is willing to wait for the call to complete. This is
 treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥">id</a></code>).
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥">id</a></code>).
 This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
 If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a>,
 or return an error if that fails.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
 that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪">DOMString</a>>, defaulting to <code>[]</code></span>
@@ -4187,20 +4180,20 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint">PublicKeyCredentialHint</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①">DOMString</a>, defaulting to <code>"none"</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none②">none</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
       <p>The default value is the empty list, which indicates no preference.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a>.
-For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> that was created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a>.
+For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
@@ -4218,19 +4211,19 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
       <ul>
        <li data-md>
-        <p>[DEPRECATED] When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Party</a>, intended only
+        <p>[DEPRECATED] When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a>, intended only
 for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".</p>
         <p>This member is deprecated because many <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">clients</a> do not display it,
-but it remains a required dictionary member for backwards compatibility. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Parties</a> MAY, as a safe default, set this equal to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
+but it remains a required dictionary member for backwards compatibility. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Parties</a> MAY, as a safe default, set this equal to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
         <ul>
          <li data-md>
-          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value, or displaying the value to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Parties</a> SHOULD consider providing this information if setting the member to a value other than the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a>.
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Parties</a> SHOULD consider providing this information if setting the member to a value other than the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a>.
 See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
           <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤①">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
@@ -4238,7 +4231,7 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
 identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">Clients</a> to help users
 understand with which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> a credential is associated.</p>
         <p>Examples of suitable values for this identifier include, "alexm", "+14255551234",
@@ -4246,12 +4239,12 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
 or "alex.mueller@example.com (ОАО Примертех)".</p>
         <ul>
          <li data-md>
-          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> SHOULD perform enforcement,
+          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> SHOULD perform enforcement,
 as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS
 IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value, or displaying the value
 to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
           <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤③">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value prior to displaying the value to the user or
@@ -4264,7 +4257,7 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> attributes when creating a new credential.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> attributes when creating a new credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①②"><c- g>id</c-></a>;
 };
@@ -4273,7 +4266,7 @@ <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-para
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a></span>
      <dd data-md>
-      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.</p>
+      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-params"><span class="secno">5.4.3. </span><span class="content">User Account Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentity"><code>PublicKeyCredentialUserEntity</code></dfn>)</span><a class="self-link" href="#dictionary-user-credential-params"></a></h4>
@@ -4298,21 +4291,21 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user accounts</a>,
 even for <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credentials</a>, because some authenticators always create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credentials</a>.
 Thus a constant <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> would prevent a user from using such an authenticator
-with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a>.</p>
+with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑤">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a>, intended only for
-display. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice
-more than necessary. If no suitable or <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑥">human-palatable</a> name is
-available, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> SHOULD set this value to an empty string.</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a>, intended only for
+display. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice
+more than necessary. If no suitable or <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑤">human-palatable</a> name is
+available, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> SHOULD set this value to an empty string.</p>
       <p>Examples of suitable values for this identifier include, "Alex Müller", "Alex Müller (ACME Co.)" or "田中倫".</p>
       <ul>
        <li data-md>
-        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value to a non-empty string,
 or displaying a non-empty value to the user.</p>
        <li data-md>
-        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
         <p><a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value prior to displaying a non-empty value to the user or
@@ -4346,20 +4339,20 @@ <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelec
 in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> operation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code>'s values and semantics.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④">required</a></code>.</p>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④">required</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> operation.
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> operation.
 The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -4376,9 +4369,9 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
       <p>This value indicates <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment①">cross-platform attachment</a>.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options, sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
+   <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options, sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
@@ -4387,26 +4380,26 @@ <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement">
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
+   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
 For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops③">Credential Properties Extension</a>.
+   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
 This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
@@ -4422,27 +4415,27 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
 the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a>.
-The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
-in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> through unmodified.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>,
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>.
+The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
+in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> in this case.
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> wants to receive an enterprise attestation, which is an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> that may include information which uniquely identifies the authenticator. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a>.</p>
-      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> wants to receive an enterprise attestation, which is an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> that may include information which uniquely identifies the authenticator. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a>.</p>
+      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
@@ -4464,12 +4457,12 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> is willing to wait for the call to complete.
+     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> is willing to wait for the call to complete.
 The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧">DOMString</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a>.
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> MUST verify
 that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a>.</p>
      <p>If not specified, its value will
@@ -4481,20 +4474,20 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
      <ul>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
-This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
+This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
        <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
 This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> —
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> —
 the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> will automatically ignore non-eligible credentials
 if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> to authenticate is not already identified,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a> or unspecified.
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a> or unspecified.
 In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a>,
 and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>,
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a>,
 the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
      <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
@@ -4502,14 +4495,14 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
 preferred credential, and the last is the least preferred.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑥">userVerification</a></code>'s values and semantics.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
      <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint①">PublicKeyCredentialHint</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
@@ -4551,7 +4544,7 @@ <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensio
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
 containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
   * $$extensionOutput .within ( tstr => any )
@@ -4592,7 +4585,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
 attacks (where an attacker substitutes one legitimate signature for another).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑨">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> of the requester, as provided to the authenticator by the client, in
@@ -4609,7 +4602,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
      <dt data-md>[RESERVED] <dfn class="dfn-paneled" data-dfn-for="CollectedClientData" data-dfn-type="dfn" data-noexport id="dom-collectedclientdata-tokenbinding">tokenBinding</dfn>
      <dd data-md>
       <p>This OPTIONAL member contains information about the state of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1">Token Binding</a> protocol <a data-link-type="biblio" href="#biblio-tokenbinding" title="The Token Binding Protocol Version 1.0">[TokenBinding]</a> used when communicating
-with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
+with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
       <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
@@ -4620,17 +4613,17 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
           <dl>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;supported&quot;|supported" id="dom-tokenbindingstatus-supported"><code>supported</code></dfn>
            <dd data-md>
-            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a>.</p>
+            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>.</p>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;present&quot;|present" id="dom-tokenbindingstatus-present"><code>present</code></dfn>
            <dd data-md>
-            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
+            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
           </dl>
          </div>
          <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
         <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②">DOMString</a></span>
         <dd data-md>
          <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑨">base64url
-encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a>.</p>
+encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a>.</p>
        </dl>
       </div>
       <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platform</a>-specific operation.</p>
@@ -4842,25 +4835,25 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
    <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a>.
 It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>,
 and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a>.</p>
-   <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a>,
+   <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential record</a>,
 and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑤">DOMString</a></span>
      <dd data-md>
       <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code>.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.
 This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> is semantically distinct.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
       <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑨">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> the caller is referring to.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
 This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥">DOMString</a>></span>
      <dd data-md>
       <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platforms</a> MUST ignore unknown values.</p>
-      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a>.
+      <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
 This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
 of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑧">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code> operation.</p>
     </dl>
@@ -4879,7 +4872,7 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
    <div>
      <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
@@ -4938,16 +4931,16 @@ <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirem
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -4965,7 +4958,7 @@ <h4 class="heading settled" data-level="5.8.7" id="enum-clientCapability"><span
 };
 </pre>
    <p>This enumeration defines a limited set of client capabilities which a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a> may evaluate to offer certain workflows and experiences to users.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities③">getClientCapabilities()</a></code> method of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> to obtain a description of available capabilities.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities③">getClientCapabilities()</a></code> method of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> to obtain a description of available capabilities.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-clientcapability" id="ref-for-enumdef-clientcapability②">ClientCapability</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
@@ -5010,21 +5003,21 @@ <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secn
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhint" id="ref-for-enumdef-publickeycredentialhint③">PublicKeyCredentialHint</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones.
+     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones.
     If the same hint appears more than once, its second and later appearences are ignored. 
     <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhint-security-key"><code>security-key</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhint-client-device"><code>client-device</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHint" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhint-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -5038,12 +5031,12 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
    <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element">iframe</a></code>s.
 To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①③">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span class="secno">5.11. </span><span class="content">Using Web Authentication across related origins</span><a class="self-link" href="#sctn-related-origins"></a></h3>
    <p>By default, Web Authentication requires that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑨">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to⑤">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②⓪">effective domain</a>.</p>
    <p>This can make deployment challenging for large environments where multiple country-specific domains are in use (e.g. example.com vs example.co.uk vs example.sg), where alternative or brand domains are required (e.g. myexampletravel.com vs examplecruises.com), and/or where platform as a service providers are used to support mobile apps.</p>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Parties</a> can opt in to allowing <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑥">WebAuthn Clients</a> to enable a credential to be created and used across a limited set of related <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origins</a>.
-Such <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Parties</a> MUST choose a common <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> to use across all ceremonies from related origins.</p>
+Such <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> MUST choose a common <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> to use across all ceremonies from related origins.</p>
    <p>A JSON document MUST be hosted at the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a>. The JSON document MUST be returned as follows:</p>
    <ul>
     <li data-md>
@@ -5116,12 +5109,12 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
 the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Parties</a>. For instance, this abstract model does not define protocols for
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -5129,17 +5122,17 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 operates at a higher security level than the rest of the authenticator. This is particularly important for authenticators that
 are embedded in the WebAuthn client, as in those cases this cryptographic module (which may, for example, be a TPM) could be
 considered more trustworthy than the rest of the authenticator.</p>
-   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid②">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle①">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a>.</p>
+   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid②">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle①">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a>.</p>
    <p>Additionally, each authenticator has an Authenticator Attestation Globally Unique Identifier or <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="aaguid">AAGUID</dfn>, which is a 128-bit identifier
 indicating the type (e.g. make and model) of the authenticator. The AAGUID MUST be chosen by its maker to be identical across all substantially identical
 authenticators made by that maker, and different (with high probability) from the AAGUIDs of all other types of authenticators. The AAGUID for a given type
-of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
-certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
+of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
+certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
 the authenticator without requesting and verifying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a>, but the AAGUID is not provably authentic without <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
 referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
 sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>.</p>
@@ -5178,7 +5171,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
 controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
 limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a>.</p>
@@ -5223,17 +5216,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
           <p>Bit 3: <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility①">Backup Eligibility</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-be">BE</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 4: <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state①">Backup State</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-bs">BS</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 5: Reserved for future use (<code>RFU2</code>).</p>
@@ -5311,17 +5304,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning,
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning,
 or a race condition might exist where the relying party is receiving and processing assertions
 in an order other than the order they were generated at the authenticator.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance or operational factors that might result in an acceptable reason for non-increasing values.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance or operational factors that might result in an acceptable reason for non-increasing values.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -5337,7 +5330,7 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
    <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
    <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
@@ -5365,25 +5358,25 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
     </table>
     <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flags</a>:</p>
    <ul>
     <li data-md>
      <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticators</a>:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registered</a> and/or an account recovery process in place.
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registered</a> and/or an account recovery process in place.
 For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> is backed up and is protected from single device loss.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
 to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>,
 such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credentials</a>.</p>
@@ -5468,7 +5461,7 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a>.
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a>.
 These authenticators also support <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a>, also called <a data-link-type="dfn" href="#passkey" id="ref-for-passkey">passkeys</a>,
 meaning they also enable authentication flows where username input is not necessary.</p>
    <p>The <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">user-verifying platform authenticator</a> class is largely obsoleted by the <a data-link-type="dfn" href="#passkey-platform-authenticator" id="ref-for-passkey-platform-authenticator②">passkey platform authenticator</a> class,
@@ -5515,15 +5508,15 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
 backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
      <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> can use it.</p>
    </ol>
    <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
@@ -5534,7 +5527,7 @@ <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modal
 credential capable</dfn>.</p>
     <li data-md>
      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
-modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential ID</a>.</p>
+modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential ID</a>.</p>
    </ul>
    <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> MAY
 at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code>.</p>
@@ -5546,8 +5539,8 @@ <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-ca
 verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> can
 verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> that is
 not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑨">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
@@ -5557,7 +5550,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
    <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>credSource</var>:</p>
+     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
        <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id②">id</a> to <var>credentialId</var>.</p>
@@ -5565,7 +5558,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑦">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map⑦">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id③">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
@@ -5581,10 +5574,10 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a>.</p>
@@ -5596,11 +5589,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -5608,11 +5601,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
@@ -5643,7 +5636,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑧">authorization gesture</a> is not to proceed with creating a credential,
 but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a>.
 If the user does not consent,
 the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
@@ -5671,7 +5664,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
       <li data-md>
        <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code>.</p>
       <li data-md>
-       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential source</a> with the fields:</p>
+       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
@@ -5753,7 +5746,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -5766,7 +5759,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
    <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> MUST perform the following procedure:</p>
@@ -5775,7 +5768,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">public key credential sources</a>.</p>
     <li data-md>
      <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
@@ -5793,7 +5786,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑥">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
-     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
+     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
     Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> may be shown
     by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
@@ -5842,7 +5835,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle④">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5880,7 +5873,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①⓪">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①⓪">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue②①">continue</a>.</p>
@@ -5895,7 +5888,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
      <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⑤">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⑤">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
    <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a>.
 When the chosen accommodation is string truncation, care needs to be taken to not corrupt the string value.</p>
@@ -5916,7 +5909,7 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
 respectively, may perform string truncation.</p>
    <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-client"><span class="secno">6.4.1.1. </span><span class="content">String Truncation by Clients</span><a class="self-link" href="#sctn-strings-truncation-client"></a></h5>
    <p>When a <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⓪">WebAuthn Client</a> truncates a string,
-the truncation behaviour observable by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> MUST satisfy the following requirements:</p>
+the truncation behaviour observable by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> MUST satisfy the following requirements:</p>
    <p>Choose a size limit equal to or greater than the specified minimum supported length.
 The string MAY be truncated so that its length in bytes in the UTF-8 character encoding satisfies that limit.
 This truncation MUST respect UTF-8 code point boundaries, and SHOULD respect <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>.
@@ -5957,34 +5950,34 @@ <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span c
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
    <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, if possible.
 If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a> can
-produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
+produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
-enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
+enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
-or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
    <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
-for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Party</a>.</p>
+for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to base a trust decision on.
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
     <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
-    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a>.</figcaption>
+    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a>.</figcaption>
    </figure>
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③">attestation statement
   formats</a> are defined in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. </div>
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①②">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
 data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
-attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>:</p>
+attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
 bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a>. In other words, this defines the
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format④">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
-     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, after verifying that it
+     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statements</a> and their underlying trust models.
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑤">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
@@ -5996,14 +5989,14 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
      <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type③">attestation type</a>, which determines the trust model,</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a> by limiting what can be
-expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a>, and</p>
+expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, and</p>
     <li data-md>
      <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
    <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
-formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Parties</a> will also need to
+formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Parties</a> will also need to
 understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data"><span class="secno">6.5.1. </span><span class="content">Attested Credential Data</span><a class="self-link" href="#sctn-attested-credential-data"></a></h4>
    <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
@@ -6105,18 +6098,18 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
     <li data-md>
      <p><strong>Supported <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑦">attestation types</a>:</strong></p>
     <li data-md>
-     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> for the extension point <code>$attStmtFormat</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
+     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> for the extension point <code>$attStmtFormat</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signing-procedure">Signing procedure</dfn>:
-The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
+The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
 the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credential</a> to be attested, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④②">authenticator data</a> structure containing the <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authenticator data for the attestation" data-noexport id="authenticator-data-for-the-attestation">authenticator data
 for the attestation</dfn>, and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">hash of the serialized client data</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure">Verification procedure</dfn>:
-The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
+The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
      <ul>
       <li data-md>
-       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statement</a> structure</p>
+       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statement</a> structure</p>
       <li data-md>
        <p><var>authenticatorData</var>: The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data-claimed-to-have-been-used-for-the-attestation"><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④③">authenticator data</a> claimed to have been used for the attestation</dfn></p>
       <li data-md>
@@ -6133,14 +6126,14 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
    </ul>
    <p>The initial list of specified <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①③">attestation statement formats</a> is in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>.</p>
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span class="secno">6.5.3. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
-   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statements</a> and their underlying trust
+   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
-calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
-section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
+section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 23</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
 Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑨">attestation</a> is acceptable
-under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> policy.</p>
+under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
     <dd data-md>
@@ -6158,16 +6151,16 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span
 "endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
 for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
-    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a>.</p>
+    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a>.</p>
     <dt data-md>No attestation statement (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="none">None</dfn>)
     <dd data-md>
      <p>In this case, no attestation information is available. See also <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a>.</p>
@@ -6238,17 +6231,17 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 The signature is not ASN.1 wrapped.</p>
    </ul>
    <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a>'s script receives
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a>'s script receives
 a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③⓪">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
-respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> server, using methods outside
-the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> must perform upon receipt of these
+respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> server, using methods outside
+the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions③">CredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a>'s needs for the ceremony.
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions③">CredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a>'s needs for the ceremony.
 Let <var>pkOptions</var> be <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code>.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">navigator.credentials.create()</a></code> and pass <var>options</var> as the argument.
@@ -6277,21 +6270,21 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
-    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a>.
+    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑦">crossOrigin</a></code></code> is present and set to <code>true</code>,
-verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> expects that this credential would have been created within an iframe
+verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> expects that this credential would have been created within an iframe
 that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> expects that this credential would have been created within an iframe that is
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li data-md>
@@ -6299,19 +6292,19 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑤">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a>.</p>
     <li data-md>
      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑦">mediation</a></code></code> is not set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code>,
 verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> for this registration,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> for this registration,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑥">pubKeyCredParams</a></code></code>.</p>
     <li data-md>
@@ -6321,7 +6314,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
 is maintained in the
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
     <li id="reg-ceremony-verify-attestation">
-     <a class="self-link" href="#reg-ceremony-verify-attestation"></a> Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>. 
+     <a class="self-link" href="#reg-ceremony-verify-attestation"></a> Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>. 
      <p class="note" role="note"><span class="marker">Note:</span> Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑥">attestation statement format</a> specifies its own <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure④">verification procedure</a>. See <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a> for
     the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
     <li id="reg-ceremony-attestation-trust-anchors"><a class="self-link" href="#reg-ceremony-attestation-trust-anchors"></a> If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates)
@@ -6331,9 +6324,9 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 21</a>, as follows: 
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate
 (i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> may be the same).</p>
@@ -6341,11 +6334,11 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
-    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code></code>,
+    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code></code>,
     with the following contents: 
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type②">type</a>
@@ -6354,7 +6347,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
-whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a>.</p>
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-publickey" id="ref-for-abstract-opdef-credential-record-publickey">publicKey</a>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
@@ -6374,7 +6367,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dd data-md>
        <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a> in <var>authData</var>.</p>
      </dl>
-     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> MAY also include the following OPTIONAL contents:</p>
+     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> MAY also include the following OPTIONAL contents:</p>
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject①">attestationObject</a>
       <dd data-md>
@@ -6382,44 +6375,40 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationclientdatajson" id="ref-for-abstract-opdef-credential-record-attestationclientdatajson">attestationClientDataJSON</a>
       <dd data-md>
        <p><code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑨">clientDataJSON</a></code></code>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a>
-      <dd data-md>
-       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">public key credential source</a>.
-This SHOULD be chosen by the user.</p>
-       <p>If <code><var>clientExtensionResults</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname①">authenticatorDisplayName</a></code></code> is present,
-then its value MAY be offered as a default for this value.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MAY alternatively derive a default value from the authenticator’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statement</a>, if any.</p>
      </dl>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">items</a> as necessary.
+    As a non-normative example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> might allow the user to set a "nickname" for the credential
+    to help the user remember which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credential</a> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to which <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a> when interacting with account settings.</p>
     <li id="reg-ceremony-verify-extension-outputs">
-     <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a>.
+     <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a>.
     Depending on each <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">extension</a>,
-    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> what to do with extension outputs.
-    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> MAY ignore any or all extension outputs. 
+    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> what to do with extension outputs.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> MAY ignore any or all extension outputs. 
      <p><a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">Clients</a> MAY set additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not
-    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code>.
-    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> MUST be prepared to handle such situations,
-    whether by ignoring the unsolicited extensions or by rejecting the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> can make this
+    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code>.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> MUST be prepared to handle such situations,
+    whether by ignoring the unsolicited extensions or by rejecting the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> MUST also be
+     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li data-md>
      <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 23</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> is asserting there
-    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a> model.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a> and credential public key but treat the
+    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> is asserting there
+    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> has a trusted method of determining acceptable trust anchors
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> has a trusted method of determining acceptable trust anchors
 in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> above.
-Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions③">CredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a>'s needs for the ceremony.
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions" id="ref-for-dictdef-credentialrequestoptions③">CredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a>'s needs for the ceremony.
 Let <var>pkOptions</var> be <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code>.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">navigator.credentials.get()</a></code> and pass <var>options</var> as the argument.
@@ -6436,19 +6425,19 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
      <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①③">is not empty</a>,
 verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credentials</a> listed in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code></code>.</p>
     <li data-md>
-     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credential</a>:</p>
+     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credential</a>:</p>
      <dl class="switch">
       <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication ceremony</a> was initiated, e.g., via a username or cookie,
       <dd data-md>
-       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a>.
+       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a>.
 If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
 verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a>.</p>
       <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> was initiated,
       <dd data-md>
        <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is present.
-Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id④">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑦">credential record</a>.</p>
+Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id④">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a>.</p>
      </dl>
     <li data-md>
      <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①⓪">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata②">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
@@ -6466,23 +6455,23 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a>.
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑧">crossOrigin</a></code></code> is present and set to <code>true</code>,
-verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑥">same-origin with its ancestors</a>.</p>
+verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑥">same-origin with its ancestors</a>.</p>
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑦">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑦">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a>. 
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is set.</p>
@@ -6494,7 +6483,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> business logic or policy,
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> business logic or policy,
 let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> bits, respectively,
 of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flags</a></code> in <var>authData</var>.
 Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code>:</p>
@@ -6504,9 +6493,9 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible③">backupEligible</a></code> is not set, verify that <var>currentBe</var> is not set.</p>
       <li data-md>
-       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> policy, if any.</p>
+       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> policy, if any.</p>
      </ol>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> values.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> values.</p>
     <li data-md>
      <p>Let <var>hash</var> be the result of computing a hash over the <var>cData</var> using SHA-256.</p>
     <li data-md>
@@ -6531,10 +6520,10 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
           <li data-md>
            <p>An authenticator is malfunctioning.</p>
           <li data-md>
-           <p>A race condition exists where the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> is processing assertion responses in an order other than the order they were generated at the authenticator.</p>
+           <p>A race condition exists where the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> is processing assertion responses in an order other than the order they were generated at the authenticator.</p>
          </ul>
-         <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> should evaluate their own operational characteristics and incorporate this information into their risk scoring.
-          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a>-specific.</p>
+         <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Parties</a> should evaluate their own operational characteristics and incorporate this information into their risk scoring.
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a>-specific.</p>
          <p>For more information on signature counter considerations, see <a href="#sctn-sign-counter">§ 6.1.1 Signature Counter Considerations</a>.</p>
        </dl>
      </ul>
@@ -6550,24 +6539,20 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
 update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flags</a> in <var>authData</var>.
 This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>;
 if not authorized, skip this step.</p>
-      <li data-md>
-       <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> is used,
-and <code><var>clientExtensionResults</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops①">credProps</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname②">authenticatorDisplayName</a></code></code> is present and not equal to <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code>,
-then OPTIONALLY offer the user to update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> to the value of <code><var>clientExtensionResults</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops②">credProps</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname③">authenticatorDisplayName</a></code></code>.</p>
      </ol>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremony</a> steps,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremony</a> steps,
     the above state updates SHOULD be deferred to after those additional checks are completed successfully.</p>
     <li id="authn-ceremony-verify-extension-outputs">
-     <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a>.
+     <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Process the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> as required by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a>.
     Depending on each <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①①">extension</a>,
-    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> what to do with extension outputs.
-    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MAY ignore any or all extension outputs. 
+    processing steps may be concretely specified or it may be up to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> what to do with extension outputs.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> MAY ignore any or all extension outputs. 
      <p><a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">Clients</a> MAY set additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not
-    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code>.
-    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> MUST be prepared to handle such situations,
-    whether by ignoring the unsolicited extensions or by rejecting the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a> can make this
+    requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code>.
+    The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MUST be prepared to handle such situations,
+    whether by ignoring the unsolicited extensions or by rejecting the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> MUST also be
+     <p>Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li data-md>
      <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>.</p>
@@ -6593,7 +6578,7 @@ <h3 class="heading settled" data-level="8.1" id="sctn-attstn-fmt-ids"><span clas
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
    <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span class="secno">8.2. </span><span class="content">Packed Attestation Statement Format</span><a class="self-link" href="#sctn-packed-attestation"></a></h3>
    <p>This is a WebAuthn optimized attestation statement format. It uses a very compact but still extensible encoding method. It is
-implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticators</a> with limited resources (e.g., secure elements).</p>
+implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticators</a> with limited resources (e.g., secure elements).</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6714,8 +6699,8 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
     <li data-md>
      <p>If the related attestation root certificate is used for multiple authenticator models, the Extension OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) MUST be present, containing the AAGUID as a 16-byte OCTET STRING.
 The extension MUST NOT be marked as critical.</p>
-     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Parties</a> may not know if the attestation root
-certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Parties</a> check if the extension
+     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> may not know if the attestation root
+certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Parties</a> check if the extension
 is present, and if it is, then validate that it contains that same AAGUID as presented in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑦">attestation object</a>.</p>
      <p>Note that an X.509 Extension encodes the DER-encoding of the value in an OCTET STRING.
 Thus, the AAGUID MUST be wrapped in <i>two</i> OCTET STRINGS to be valid.</p>
@@ -6885,7 +6870,7 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
@@ -6963,7 +6948,7 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
    <p class="note" role="note"><span class="marker">Note:</span> This format is deprecated and is expected to be removed in a future revision of this document.</p>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -7111,9 +7096,9 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> MAY also directly generate attestation statements of this format
-if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestation</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> MAY also directly generate attestation statements of this format
+if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestation</a>.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -7229,9 +7214,9 @@ <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><spa
      <ol>
       <li data-md>
        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①③">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
-       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> policy.</p>
+       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
+       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
 return implementation-specific values representing any combination of outputs from successful <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedures</a>.</p>
      </ol>
    </dl>
@@ -7250,7 +7235,7 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
    <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call
 (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
@@ -7270,11 +7255,11 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①②">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①②">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①③">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> does not endanger the user’s security or privacy.
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①③">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
 that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension inputs</a> from JSON to CBOR
 will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
@@ -7305,7 +7290,7 @@ <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
    <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> know that the extension was honored by the authenticator. If an
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
@@ -7315,7 +7300,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -7334,8 +7319,8 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 <c- p>});</c->
 </pre>
    <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a>.</p>
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
 authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension
 input</a>,
@@ -7372,7 +7357,7 @@ <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-pr
 as a separate map, keyed with the same <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②①">extension identifier</a>. This map only contains entries for authenticator
 extensions that make use of unsigned outputs. Unsigned outputs are useful when extensions output a signature over
 the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a> (because otherwise a signature would have to sign over itself, which isn’t possible) or when
-some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a>.</p>
+some extension outputs should not be sent to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs④">unsigned extension outputs</a> are returned as a CBOR map in a top-level field named <code>unsignedExtensionOutputs</code> from both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑨">authenticatorGetAssertion</a>.</p>
    <p>For each supported extension, the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing④">authenticator extension processing</a> rule for that extension is used create the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a>, and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑤">unsigned extension output</a> if used, from the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑦">authenticator extension input</a> and possibly also other inputs.
 There MUST NOT be any values returned for ignored extensions.</p>
@@ -7385,11 +7370,11 @@ <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
    <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
 order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> option
@@ -7412,8 +7397,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
 but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> might be "example.com".</p>
    <dl>
@@ -7460,7 +7445,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤③">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤③">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code></dfn>;
 };
@@ -7477,7 +7462,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
    <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②③">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑧">excludeCredentials</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②③">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑧">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7552,7 +7537,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
 };
@@ -7568,39 +7553,30 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑨">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">public key credential source</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑨">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremony</a>.</p>
+   <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>credProps</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean" id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
     <dd data-md>
-     <ol>
-      <li data-md>
-       <p>If processed during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremony</a>:</p>
-       <ol>
-        <li data-md>
-         <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
-       </ol>
-      <li data-md>
-       <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> as described in its definition, using some client-specific procedure.
-If no suitable value is found, let <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑤">authenticatorDisplayName</a></code> be undefined.</p>
-     </ol>
+     <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
     <dt data-md>Client extension output
     <dd data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑥">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> operation.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②"><c- g>rk</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑥"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -7611,30 +7587,12 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①">boolean</a></span>
        <dd data-md>
-        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn>,
+        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn> or as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn>,
 is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③①">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑧">DOMString</a></span>
-       <dd data-md>
-        <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑧">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
-chosen by the user.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> MUST allow the user to choose this value.
-That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication</a> ceremony or MAY be made available outside
-the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> MAY reuse the same value
-for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a>.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a>, by some unspecified mechanism, for this
-value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> MAY allow the user to configure the response to such a
-query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> vendor MAY provide a default response to such a query.
-The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> MAY consider a user-configured response chosen by the user,
-and SHOULD allow the user to modify a vendor-provided default response.</p>
-        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname④">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑦">authenticatorDisplayName</a></code> extension output,
-if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname⑤">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a>.</p>
-        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑧">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname⑥">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname⑦">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②①">credential record</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -7648,18 +7606,18 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
-   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
    <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> is identical.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>prf</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfvalues"><code><c- g>AuthenticationExtensionsPRFValues</c-></code></dfn> {
@@ -7680,7 +7638,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-eval"><code>eval</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues②">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
-        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
+        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
        <dd data-md>
         <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②④">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is not empty.</p>
@@ -7706,7 +7664,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <li data-md>
        <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results">results</a></code> to the decrypted PRF result(s), if any.</p>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
@@ -7731,14 +7689,14 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
         <li data-md>
          <p>If <code><var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second②">second</a></code></code> is present, let <code>salt2</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second③">second</a></code>)</code>.</p>
         <li data-md>
-         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
+         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
         <li data-md>
          <p>Decrypt the extension result and set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results①">results</a></code> to the PRF result(s), if any.</p>
        </ol>
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
@@ -7772,8 +7730,8 @@ <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors
 The examples are not exhaustive.</p>
    <ul>
     <li data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled③">enabled</a></code> output is always present during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>,
-and never present during <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremonies</a>:</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled③">enabled</a></code> output is always present during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremonies</a>,
+and never present during <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremonies</a>:</p>
 <pre class="example highlight" id="example-5584eab4"><a class="self-link" href="#example-5584eab4"></a><c- c1>// Example extension inputs:</c->
 <c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
 
@@ -7786,7 +7744,7 @@ <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors
 </pre>
     <li data-md>
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑤">results</a></code> output may be present
-during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑨">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑥">evalByCredential</a></code> input is present:</p>
+during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremonies</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremonies</a> if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑨">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑥">evalByCredential</a></code> input is present:</p>
 <pre class="example highlight" id="example-70210d97"><a class="self-link" href="#example-70210d97"></a><c- c1>// Example extension inputs:</c->
 <c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> eval<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>])</c-> <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
 
@@ -7964,21 +7922,21 @@ <h5 class="heading settled" data-level="10.1.4.2" id="prf-extension-test-vectors
      <p><code>iv</code> in two-input <code>output_enc</code> with PIN protocol 2: Truncated <code>SHA-256(seed || 0x0a)</code></p>
    </ul>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs">large, per-credential blobs</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>,
 and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑧">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑥">required</a></code>.
-However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②⓪">discoverable credentials</a>.</p>
+However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②⓪">discoverable credentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>largeBlob</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①⓪"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7991,22 +7949,22 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑨"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
     <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧⓪">DOMString</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑧">DOMString</a></span>
        <dd data-md>
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑥">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -8038,7 +7996,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
          <p>If an <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator">authenticator is selected</a> and the <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator①">selected authenticator</a> supports large blobs, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported①">supported</a></code> to <code>true</code>, and <code>false</code> otherwise.</p>
        </ol>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
@@ -8074,7 +8032,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
            <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException④①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑨">NotSupportedError</a></code>”.</p>
          </ol>
         <li data-md>
-         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, associated with the indicated credential.</p>
+         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticator</a>, associated with the indicated credential.</p>
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written">written</a></code> to <code>true</code> if successful and <code>false</code> otherwise.</p>
        </ol>
@@ -8101,12 +8059,12 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid⑤">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a>, associated with the specified credential.</p>
+        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a>, associated with the specified credential.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
@@ -8224,12 +8182,12 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
 It MUST NOT support any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑦">authenticator extension</a> not present in its <var>extensions</var> array.</p>
     <dt data-md><var>defaultBackupEligibility</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">virtual authenticator</a>.</p>
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">Public Key Credential Source</a>.
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">virtual authenticator</a>.</p>
     <dt data-md><var>defaultBackupState</var>
     <dd data-md>
-     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑤">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
+     <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">Public Key Credential Source</a>.
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑤">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②③">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-authenticator"><span class="secno">11.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-virtual-authenticator">Add Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-add-virtual-authenticator"></a></h3>
    <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①③">Virtual Authenticator</a>. It is
@@ -8378,7 +8336,7 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑧">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑧">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -8422,24 +8380,24 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
        <td>string
       <tr>
        <td><var>signCount</var>
-       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>.
+       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦①">public key credential source</a>.
        <td>number
       <tr>
        <td><var>largeBlob</var>
-       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③①">Base64url Encoding</a>.
+       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦②">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③①">Base64url Encoding</a>.
                     This property may not be defined. 
        <td>string
       <tr>
        <td><var>backupEligibility</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
+       <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦③">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
                     The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①③">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑤">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. 
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>. 
        <td>boolean
       <tr>
        <td><var>backupState</var>
-       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupState</var> property.
+       <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupState</var> property.
                     The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑥">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑥">flag</a> when performing
-                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">public key credential source</a>. 
+                    an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. 
        <td>boolean
       <tr>
        <td><var>userName</var>
@@ -8566,7 +8524,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②③">Virtual Authenticator</a>, regardless of whether they were
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②③">Virtual Authenticator</a>, regardless of whether they were
 stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
@@ -8588,13 +8546,13 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
     <li data-md>
      <p>Let <var>credentialsArray</var> be an empty array.</p>
     <li data-md>
-     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
+     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑧">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
 construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -8615,14 +8573,14 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
     <li data-md>
      <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
-     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
+     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⓪">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
+     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧①">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧②">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -8641,7 +8599,7 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑨">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②①">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⓪">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧③">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⓪">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
@@ -8678,7 +8636,7 @@ <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verif
    </ol>
    <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credential-properties"><span class="secno">11.10. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-credential-properties">Set Credential Properties</dfn></span><a class="self-link" href="#sctn-automation-set-credential-properties"></a></h3>
    <p>The <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties">Set Credential Properties</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands①⓪">extension command</a> allows setting the <var>backupEligibility</var> and <var>backupState</var> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑧">credential properties</a> of
-a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③④">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑥">public key credential source</a>. It is defined as follows:</p>
+a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③④">Virtual Authenticator</a>'s <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧④">public key credential source</a>. It is defined as follows:</p>
    <figure class="table" id="table-setFlags">
     <table class="data">
      <thead>
@@ -8720,14 +8678,14 @@ <h3 class="heading settled" data-level="11.10" id="sctn-automation-set-credentia
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③⑤">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑧">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑥">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑦">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
+     <p>Let <var>credential</var> be the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑤">public key credential source</a> managed by <var>authenticator</var> matched by <var>credentialId</var>.</p>
     <li data-md>
      <p>If <var>credential</var> is empty, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⑦">invalid argument</a>.</p>
     <li data-md>
      <p>Let <var>backupEligibility</var> be the <var>parameters</var>’ <var>backupEligibility</var> property.</p>
     <li data-md>
      <p>If <var>backupEligibility</var> is defined, set the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑨">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties①①">credential property</a> of <var>credential</var> to the value of <var>backupEligibility</var>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑧">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> Normally, the <var>backupEligibility</var> property is permanent to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑧⑥">public key credential source</a>. <a data-link-type="dfn" href="#set-credential-properties" id="ref-for-set-credential-properties①">Set Credential Properties</a> allows changing it for testing and debugging purposes.</p>
     <li data-md>
      <p>Let <var>backupState</var> be the <var>parameters</var>’ <var>backupState</var> property.</p>
     <li data-md>
@@ -8798,7 +8756,7 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥②">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥②">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
@@ -8815,14 +8773,14 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥④">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a>'s properties,
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥④">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
@@ -8830,42 +8788,42 @@ <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><s
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
 The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑤">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Parties</a> as to their provenance.</p>
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
-Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> security characteristics.</p>
+Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
-This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> returns
+This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> returns
 the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑥">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
 For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
-must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>.
-This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> that can be invoked remotely —
-even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
+must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>.
+This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> that can be invoked remotely —
+even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> has to trust the third party to
-enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a>.
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> has to trust the third party to
+enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
-and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
-   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
+and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
+   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span class="secno">13.3.1. </span><span class="content">Attestation Certificate Hierarchy</span><a class="self-link" href="#sctn-cert-hierarchy"></a></h4>
    <p>A 3-tier hierarchy for attestation certificates is RECOMMENDED (i.e., Attestation Root, Attestation Issuing CA, Attestation
 Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
@@ -8874,45 +8832,45 @@ <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span c
 SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a>.</p>
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer that
-has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificates</a> for these keys from a new
+has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificates</a> for these keys from a new
 intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑦">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
    <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑧">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> can optionally
-enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> can optionally
+enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticators</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
-Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
+     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
+Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
-methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
+methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
 to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>Challenges SHOULD be valid for a duration similar to the
@@ -8921,92 +8879,92 @@ <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenge
 therefore be at least 16 bytes long.</p>
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
-However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a> was generated
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a>, if present,
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> qualities.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
+However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a>, on its own,
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a> was generated
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> maintains
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③④">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a>: unscathed
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③④">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> reports
-a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a> model than the user expects.</p>
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> reports
+a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> also
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> also
 un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to the
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑧">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code></code> options to ensure that these
-different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticators</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑧">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code></code> options to ensure that these
+different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
-For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a>,
+For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a> by providing only a username,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>.
 The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑧">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑨">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
 and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑨">origins</a>.</p>
     <li data-md>
      <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.
-For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑨">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑥">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⓪">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑥">RP ID</a> <code>example.org</code>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑧">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①⓪">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①⓪">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credentials</a>.</p>
    </ul>
    <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><span class="secno">13.4.9. </span><span class="content">Validating the origin of a credential</span><a class="self-link" href="#sctn-validating-origin"></a></h4>
    <p>When <a href="#rp-op-registering-a-new-credential-step-origin">registering a credential</a> and
 when <a href="#rp-op-verifying-assertion-step-origin">verifying an assertion</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
-   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
-as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⓪">credentials</a>.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
+   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
+as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③①">credentials</a>.
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of WebAuthn credentials prevents their use on domains
 outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑦">RP ID</a> they were registered for,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a>'s origin validation serves as an additional layer of protection
-in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a>'s origin validation serves as an additional layer of protection
+in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
-   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>.
+   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -9025,11 +8983,11 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
      <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥①">RP ID</a>.</p>
     <li data-md>
      <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> to be an operating system dependent
-identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②⓪">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
+identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②⓪">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
    <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①③">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> MUST validate that its value is expected.
-This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> MUST validate that its value is expected.
+This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -9047,7 +9005,7 @@ <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><sp
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -9059,123 +9017,123 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
      <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>.</p>
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②②">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②③">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> depending on the implementation.</p>
     <li data-md>
-     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②④">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a>.</p>
+     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticators</a>, e.g., product names.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
     <li data-md>
-     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a>.</p>
+     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticators</a>, e.g., serial numbers.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①②①">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
    <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦①">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Parties</a>.</p>
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑥">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑦">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①②②">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①②③">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②⑧">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②④">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a> registered and available.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Parties</a> thus cannot correlate users between their
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">public key credentials</a> are
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑦">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>.</p>
-   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑤">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑦">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a>.</p>
+   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
 or link various online identities of the same user together.
 This can be mitigated in several ways, including:</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑨">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticators</a> in batches
-where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑨">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticators</a> in batches
+where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
 This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">private key</a> is compromised.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
 while also minimizing the batch size in order to limit the number of affected users
 in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">attestation private key</a> is compromised.</p>
-     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">attestation certificate</a> in order to produce
+     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">attestation certificate</a> in order to produce
 sufficiently large groups. This may serve as guidance about suitable batch sizes.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②⓪">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③①">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> can ship with a
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②⓪">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③②">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> can ship with a
 main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">certificate</a>),
 and combined with a cloud-operated <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑦">Anonymization CA</a>,
-can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③②">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②②">attestation certificates</a>.</p>
+can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③③">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②②">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> In various places outside this specification, the term "Privacy CA" is used to refer to what is termed here
     as an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑧">Anonymization CA</a>. Because the Trusted Computing Group (TCG) also used the term "Privacy CA" to refer to what
     the TCG now refers to as an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca③">Attestation CA</a> (ACA) <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a>, we are using the term <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑨">Anonymization CA</a> here to try to mitigate
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①③⓪">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①③①">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③③">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication
-ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> has been
-performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a> SHOULD NOT store personally identifying information.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①②⑥">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②⑦">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication
+ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> has been
+performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a> SHOULD NOT store personally identifying information.</p>
    <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①①">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑨">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
-   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①③②">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a>'s enrolled user(s).</p>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①②⑧">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑧">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a>:</p>
    <ul>
     <li data-md>
-     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> are present.</p>
+     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticators</a> are present.</p>
     <li data-md>
-     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is excluded.</p>
+     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> could identify the user by probing for
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled
 before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credential</a> is not available.</p>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧③">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> could identify the user by probing
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧④">credentials</a> are available.
 For example, one such information leak may happen if the client displays instructions and controls
-for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③④">credential</a>.
-In this case, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> is aware of this <a data-link-type="dfn" href="#client" id="ref-for-client①③③">client</a> behavior,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+for canceling or proceeding with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> only after discovering an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> that <a data-link-type="dfn" href="#contains" id="ref-for-contains③">contains</a> a named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑤">credential</a>.
+In this case, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> is aware of this <a data-link-type="dfn" href="#client" id="ref-for-client①②⑨">client</a> behavior,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⑤">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> parameter is
 available to the user.</p>
-   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> at any time,
-regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑤">credentials</a> are available.</p>
+   <p>This concern may be addressed by displaying controls allowing the user to cancel an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> at any time,
+regardless of whether any named <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③⑥">credentials</a> are available.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
@@ -9183,42 +9141,42 @@ <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><sp
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
-and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> may implement to mitigate or prevent information
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑥">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> responds with a failure, but then
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑧">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
 send a message to this address, containing an unpredictable one-time code and instructions for how to use it to
 proceed with the ceremony. Display the same message to the user in the web interface regardless of the contents of the
 sent e-mail and whether or not this e-mail address was already registered.</p>
@@ -9228,23 +9186,23 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⓪">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤①">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> matching the provided username, continue the
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤②">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
 before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
@@ -9252,37 +9210,37 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑥">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Parties</a>,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑥">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑦">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑦">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑧">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a> could for example:</p>
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticators</a>.</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑥">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑨">credential IDs</a>.</p>
     <li data-md>
      <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
 so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> argument is not needed.</p>
    </ul>
    <p>If the above prevention measures are not available,
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑨">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥⓪">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <p>When <a data-link-type="dfn" href="#signal-methods" id="ref-for-signal-methods⑥">signalling</a> that a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥①">credential id</a> was not recognized,
 the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑦">WebAuthn Relying Party</a> SHOULD use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalunknowncredential" id="ref-for-dom-publickeycredential-signalunknowncredential⑤">signalUnknownCredential(options)</a></code> method instead of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-signalallacceptedcredentials" id="ref-for-dom-publickeycredential-signalallacceptedcredentials⑦">signalAllAcceptedCredentials(options)</a></code> method to avoid
 exposing <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑥②">credential IDs</a> to an unauthenticated caller.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑨">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑦">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤⑤">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -9457,12 +9415,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#authenticator-data-for-the-attestation">authenticator data for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#assertioncreationdata-authenticatordataresult">authenticatorDataResult</a><span>, in § 5.1.4.1</span>
-   <li>
-    authenticatorDisplayName
-    <ul>
-     <li><a href="#abstract-opdef-credential-record-authenticatordisplayname">abstract-op for credential record</a><span>, in § 4</span>
-     <li><a href="#dom-credentialpropertiesoutput-authenticatordisplayname">dict-member for CredentialPropertiesOutput</a><span>, in § 10.1.3</span>
-    </ul>
    <li><a href="#authenticator-extension">authenticator extension</a><span>, in § 9</span>
    <li><a href="#authenticator-extension-capabilities">Authenticator Extension Capabilities</a><span>, in § 11.1.1</span>
    <li><a href="#authenticator-extension-input">authenticator extension input</a><span>, in § 9.3</span>
@@ -9554,6 +9506,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#client-side">Client-Side</a><span>, in § 4</span>
    <li><a href="#client-side-credential-storage-modality">client-side credential storage modality</a><span>, in § 6.2.2</span>
    <li><a href="#client-side-discoverable-credential">Client-side discoverable Credential</a><span>, in § 4</span>
+   <li><a href="#credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a><span>, in § 10.1.3</span>
    <li><a href="#client-side-discoverable-public-key-credential-source">Client-side discoverable Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#dictdef-collectedclientdata">CollectedClientData</a><span>, in § 5.8.1</span>
    <li><a href="#dom-clientcapability-conditionalcreate">"conditionalCreate"</a><span>, in § 5.8.7</span>
@@ -10843,7 +10796,6 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 
 <c- b>dictionary</c-> <a href="#dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-credentialpropertiesoutput-rk"><c- g>rk</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-credentialpropertiesoutput-authenticatordisplayname"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -11375,7 +11327,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "0204d188": {"dfnID":"0204d188","dfnText":"size","external":true,"refSections":[{"refs":[{"id":"ref-for-list-size"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-size\u2460"},{"id":"ref-for-list-size\u2461"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://infra.spec.whatwg.org/#list-size"},
 "0303e8e5": {"dfnID":"0303e8e5","dfnText":"UTF-8 encode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-encode"}],"title":"8.5. Android SafetyNet Attestation Statement Format"}],"url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
 "03afaf9c": {"dfnID":"03afaf9c","dfnText":"empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-empty"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-empty\u2460"},{"id":"ref-for-list-empty\u2461"},{"id":"ref-for-list-empty\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-empty\u2463"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-list-empty\u2464"},{"id":"ref-for-list-empty\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-empty\u2466"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-list-empty\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"https://infra.spec.whatwg.org/#list-empty"},
-"0e6b2056": {"dfnID":"0e6b2056","dfnText":"set (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-set"},{"id":"ref-for-map-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2461"},{"id":"ref-for-map-set\u2462"},{"id":"ref-for-map-set\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://infra.spec.whatwg.org/#map-set"},
+"0e6b2056": {"dfnID":"0e6b2056","dfnText":"set (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-set"},{"id":"ref-for-map-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2461"},{"id":"ref-for-map-set\u2462"},{"id":"ref-for-map-set\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-set\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"https://infra.spec.whatwg.org/#map-set"},
 "118b92bb": {"dfnID":"118b92bb","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"}],"title":"3. Dependencies"}],"url":"https://url.spec.whatwg.org#concept-url-scheme"},
 "1243a891": {"dfnID":"1243a891","dfnText":"exist","external":true,"refSections":[{"refs":[{"id":"ref-for-map-exists"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-map-exists\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-map-exists\u2461"},{"id":"ref-for-map-exists\u2462"},{"id":"ref-for-map-exists\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-map-exists\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-map-exists\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-map-exists\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-exists"},
 "12b8dfc0": {"dfnID":"12b8dfc0","dfnText":"current settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-current-settings-object"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-current-settings-object\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
@@ -11437,7 +11389,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "696a29e8": {"dfnID":"696a29e8","dfnText":"Request a Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-abstract-opdef-request-a-credential\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential"},
 "6b815fdd": {"dfnID":"6b815fdd","dfnText":"is empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
 "6f944459": {"dfnID":"6f944459","dfnText":"same-origin with its ancestors","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin-with-its-ancestors"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2463"},{"id":"ref-for-same-origin-with-its-ancestors\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-same-origin-with-its-ancestors\u2465"},{"id":"ref-for-same-origin-with-its-ancestors\u2466"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors"},
-"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"},{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2464"},{"id":"ref-for-concept-credential\u2460\u2465"},{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2463"},{"id":"ref-for-concept-credential\u2461\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"},{"id":"ref-for-concept-credential\u2461\u2468"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2462\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2460"},{"id":"ref-for-concept-credential\u2462\u2461"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2463"},{"id":"ref-for-concept-credential\u2462\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
+"736ad5f8": {"dfnID":"736ad5f8","dfnText":"credential","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-credential"},{"id":"ref-for-concept-credential\u2460"},{"id":"ref-for-concept-credential\u2461"},{"id":"ref-for-concept-credential\u2462"},{"id":"ref-for-concept-credential\u2463"},{"id":"ref-for-concept-credential\u2464"},{"id":"ref-for-concept-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-credential\u2466"},{"id":"ref-for-concept-credential\u2467"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2460\u24ea"},{"id":"ref-for-concept-credential\u2460\u2460"},{"id":"ref-for-concept-credential\u2460\u2461"},{"id":"ref-for-concept-credential\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2464"},{"id":"ref-for-concept-credential\u2460\u2465"},{"id":"ref-for-concept-credential\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-credential\u2460\u2468"},{"id":"ref-for-concept-credential\u2461\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2464"},{"id":"ref-for-concept-credential\u2461\u2465"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2467"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-concept-credential\u2461\u2468"},{"id":"ref-for-concept-credential\u2462\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2460"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2461"},{"id":"ref-for-concept-credential\u2462\u2462"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2463"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-concept-credential\u2462\u2464"},{"id":"ref-for-concept-credential\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"https://w3c.github.io/webappsec-credential-management/#concept-credential"},
 "7393da89": {"dfnID":"7393da89","dfnText":"same origin","external":true,"refSections":[{"refs":[{"id":"ref-for-same-origin"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-origin"},
 "7482107b": {"dfnID":"7482107b","dfnText":"WebDriver error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"},{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"},{"id":"ref-for-dfn-error-code\u2468"},{"id":"ref-for-dfn-error-code\u2460\u24ea"},{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"},{"id":"ref-for-dfn-error-code\u2460\u2462"},{"id":"ref-for-dfn-error-code\u2460\u2463"},{"id":"ref-for-dfn-error-code\u2460\u2464"},{"id":"ref-for-dfn-error-code\u2460\u2465"},{"id":"ref-for-dfn-error-code\u2460\u2466"},{"id":"ref-for-dfn-error-code\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u24ea"},{"id":"ref-for-dfn-error-code\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2462"},{"id":"ref-for-dfn-error-code\u2461\u2463"},{"id":"ref-for-dfn-error-code\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2465"},{"id":"ref-for-dfn-error-code\u2461\u2466"},{"id":"ref-for-dfn-error-code\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
 "7787d359": {"dfnID":"7787d359","dfnText":"record","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-record"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-record\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-record"},
@@ -11463,7 +11415,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "87d65d53": {"dfnID":"87d65d53","dfnText":"section 7","external":true,"refSections":[{"refs":[{"id":"ref-for-section-7"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-section-7\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-section-7\u2461"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-section-7\u2462"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://tools.ietf.org/html/rfc9052#section-7"},
 "87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"},{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2462"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"},{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
 "8841d736": {"dfnID":"8841d736","dfnText":"internal method","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
-"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"},{"id":"ref-for-idl-DOMString\u2460\u2460"},{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"},{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"},{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"},{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"},{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"},{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"},{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"},{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"},{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"},{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"},{"id":"ref-for-idl-DOMString\u2466\u2464"},{"id":"ref-for-idl-DOMString\u2466\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2466"},{"id":"ref-for-idl-DOMString\u2466\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2468"},{"id":"ref-for-idl-DOMString\u2467\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
+"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"},{"id":"ref-for-idl-DOMString\u2460\u2460"},{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"},{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"},{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"},{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"},{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"},{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"},{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"},{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"},{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"},{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"},{"id":"ref-for-idl-DOMString\u2466\u2464"},{"id":"ref-for-idl-DOMString\u2466\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2466"},{"id":"ref-for-idl-DOMString\u2466\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
 "889e932f": {"dfnID":"889e932f","dfnText":"Exposed","external":true,"refSections":[{"refs":[{"id":"ref-for-Exposed"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-Exposed\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-Exposed\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-Exposed\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#Exposed"},
 "8958b003": {"dfnID":"8958b003","dfnText":"entry","external":true,"refSections":[{"refs":[{"id":"ref-for-map-entry"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-entry\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-entry"},
 "8a30477b": {"dfnID":"8a30477b","dfnText":"global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-global"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-settings-object-global\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
@@ -11505,7 +11457,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "abstract-opdef-asynchronous-rp-id-validation-algorithm": {"dfnID":"abstract-opdef-asynchronous-rp-id-validation-algorithm","dfnText":"Asynchronous RP ID validation algorithm","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2461"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-abstract-opdef-asynchronous-rp-id-validation-algorithm\u2462"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#abstract-opdef-asynchronous-rp-id-validation-algorithm"},
 "abstract-opdef-credential-record-attestationclientdatajson": {"dfnID":"abstract-opdef-credential-record-attestationclientdatajson","dfnText":"attestationClientDataJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationclientdatajson"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-attestationclientdatajson"},
 "abstract-opdef-credential-record-attestationobject": {"dfnID":"abstract-opdef-credential-record-attestationobject","dfnText":"attestationObject","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-attestationobject\u2460"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-attestationobject"},
-"abstract-opdef-credential-record-authenticatordisplayname": {"dfnID":"abstract-opdef-credential-record-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2460"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2461"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2463"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2464"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2465"},{"id":"ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#abstract-opdef-credential-record-authenticatordisplayname"},
 "abstract-opdef-credential-record-backupeligible": {"dfnID":"abstract-opdef-credential-record-backupeligible","dfnText":"backupEligible","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2461"},{"id":"ref-for-abstract-opdef-credential-record-backupeligible\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupeligible"},
 "abstract-opdef-credential-record-backupstate": {"dfnID":"abstract-opdef-credential-record-backupstate","dfnText":"backupState","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2460"},{"id":"ref-for-abstract-opdef-credential-record-backupstate\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-backupstate"},
 "abstract-opdef-credential-record-id": {"dfnID":"abstract-opdef-credential-record-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-id\u2462"},{"id":"ref-for-abstract-opdef-credential-record-id\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-id"},
@@ -11542,7 +11493,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "attestation-private-key": {"dfnID":"attestation-private-key","dfnText":"attestation private key","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-private-key"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-private-key\u2460"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-private-key\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-private-key\u2462"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-private-key\u2463"},{"id":"ref-for-attestation-private-key\u2464"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-private-key\u2465"},{"id":"ref-for-attestation-private-key\u2466"},{"id":"ref-for-attestation-private-key\u2467"}],"title":"14.4.1. Attestation Privacy"}],"url":"#attestation-private-key"},
 "attestation-public-key": {"dfnID":"attestation-public-key","dfnText":"attestation public key","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-public-key"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-public-key\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}],"url":"#attestation-public-key"},
 "attestation-signature": {"dfnID":"attestation-signature","dfnText":"attestation signature","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-signature"},{"id":"ref-for-attestation-signature\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-signature\u2461"},{"id":"ref-for-attestation-signature\u2462"},{"id":"ref-for-attestation-signature\u2463"},{"id":"ref-for-attestation-signature\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-attestation-signature\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-attestation-signature\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-signature\u2467"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-signature\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u24ea"},{"id":"ref-for-attestation-signature\u2460\u2460"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2461"},{"id":"ref-for-attestation-signature\u2460\u2462"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-signature\u2460\u2463"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#attestation-signature"},
-"attestation-statement": {"dfnID":"attestation-statement","dfnText":"attestation statement","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement"},{"id":"ref-for-attestation-statement\u2460"},{"id":"ref-for-attestation-statement\u2461"},{"id":"ref-for-attestation-statement\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-statement\u2463"},{"id":"ref-for-attestation-statement\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attestation-statement\u2465"},{"id":"ref-for-attestation-statement\u2466"},{"id":"ref-for-attestation-statement\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement\u2468"},{"id":"ref-for-attestation-statement\u2460\u24ea"},{"id":"ref-for-attestation-statement\u2460\u2460"},{"id":"ref-for-attestation-statement\u2460\u2461"},{"id":"ref-for-attestation-statement\u2460\u2462"},{"id":"ref-for-attestation-statement\u2460\u2463"},{"id":"ref-for-attestation-statement\u2460\u2464"},{"id":"ref-for-attestation-statement\u2460\u2465"},{"id":"ref-for-attestation-statement\u2460\u2466"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2468"},{"id":"ref-for-attestation-statement\u2461\u24ea"},{"id":"ref-for-attestation-statement\u2461\u2460"},{"id":"ref-for-attestation-statement\u2461\u2461"},{"id":"ref-for-attestation-statement\u2461\u2462"},{"id":"ref-for-attestation-statement\u2461\u2463"},{"id":"ref-for-attestation-statement\u2461\u2464"},{"id":"ref-for-attestation-statement\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement\u2461\u2466"},{"id":"ref-for-attestation-statement\u2461\u2467"},{"id":"ref-for-attestation-statement\u2461\u2468"},{"id":"ref-for-attestation-statement\u2462\u24ea"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2460"},{"id":"ref-for-attestation-statement\u2462\u2461"},{"id":"ref-for-attestation-statement\u2462\u2462"},{"id":"ref-for-attestation-statement\u2462\u2463"},{"id":"ref-for-attestation-statement\u2462\u2464"},{"id":"ref-for-attestation-statement\u2462\u2465"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2466"},{"id":"ref-for-attestation-statement\u2462\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2468"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u24ea"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2460"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2461"},{"id":"ref-for-attestation-statement\u2463\u2462"},{"id":"ref-for-attestation-statement\u2463\u2463"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2464"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#attestation-statement"},
+"attestation-statement": {"dfnID":"attestation-statement","dfnText":"attestation statement","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement"},{"id":"ref-for-attestation-statement\u2460"},{"id":"ref-for-attestation-statement\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-attestation-statement\u2462"},{"id":"ref-for-attestation-statement\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-attestation-statement\u2464"},{"id":"ref-for-attestation-statement\u2465"},{"id":"ref-for-attestation-statement\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement\u2467"},{"id":"ref-for-attestation-statement\u2468"},{"id":"ref-for-attestation-statement\u2460\u24ea"},{"id":"ref-for-attestation-statement\u2460\u2460"},{"id":"ref-for-attestation-statement\u2460\u2461"},{"id":"ref-for-attestation-statement\u2460\u2462"},{"id":"ref-for-attestation-statement\u2460\u2463"},{"id":"ref-for-attestation-statement\u2460\u2464"},{"id":"ref-for-attestation-statement\u2460\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-attestation-statement\u2460\u2467"},{"id":"ref-for-attestation-statement\u2460\u2468"},{"id":"ref-for-attestation-statement\u2461\u24ea"},{"id":"ref-for-attestation-statement\u2461\u2460"},{"id":"ref-for-attestation-statement\u2461\u2461"},{"id":"ref-for-attestation-statement\u2461\u2462"},{"id":"ref-for-attestation-statement\u2461\u2463"},{"id":"ref-for-attestation-statement\u2461\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement\u2461\u2465"},{"id":"ref-for-attestation-statement\u2461\u2466"},{"id":"ref-for-attestation-statement\u2461\u2467"},{"id":"ref-for-attestation-statement\u2461\u2468"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u24ea"},{"id":"ref-for-attestation-statement\u2462\u2460"},{"id":"ref-for-attestation-statement\u2462\u2461"},{"id":"ref-for-attestation-statement\u2462\u2462"},{"id":"ref-for-attestation-statement\u2462\u2463"},{"id":"ref-for-attestation-statement\u2462\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2466"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-attestation-statement\u2462\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u24ea"},{"id":"ref-for-attestation-statement\u2463\u2460"},{"id":"ref-for-attestation-statement\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-attestation-statement\u2463\u2462"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#attestation-statement"},
 "attestation-statement-format": {"dfnID":"attestation-statement-format","dfnText":"attestation statement format","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2461"},{"id":"ref-for-attestation-statement-format\u2462"},{"id":"ref-for-attestation-statement-format\u2463"},{"id":"ref-for-attestation-statement-format\u2464"},{"id":"ref-for-attestation-statement-format\u2465"},{"id":"ref-for-attestation-statement-format\u2466"},{"id":"ref-for-attestation-statement-format\u2467"},{"id":"ref-for-attestation-statement-format\u2468"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u24ea"},{"id":"ref-for-attestation-statement-format\u2460\u2460"},{"id":"ref-for-attestation-statement-format\u2460\u2461"},{"id":"ref-for-attestation-statement-format\u2460\u2462"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2463"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2464"},{"id":"ref-for-attestation-statement-format\u2460\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-statement-format\u2460\u2466"}],"title":"8.1. Attestation Statement Format Identifiers"}],"url":"#attestation-statement-format"},
 "attestation-statement-format-identifier": {"dfnID":"attestation-statement-format-identifier","dfnText":"attestation statement format identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-statement-format-identifier"},{"id":"ref-for-attestation-statement-format-identifier\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2461"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2462"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2463"}],"title":"8.1. Attestation Statement Format Identifiers"},{"refs":[{"id":"ref-for-attestation-statement-format-identifier\u2464"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#attestation-statement-format-identifier"},
 "attestation-trust-path": {"dfnID":"attestation-trust-path","dfnText":"attestation trust path","external":false,"refSections":[{"refs":[{"id":"ref-for-attestation-trust-path"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-attestation-trust-path\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-attestation-trust-path\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-attestation-trust-path\u2462"},{"id":"ref-for-attestation-trust-path\u2463"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2464"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2465"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2466"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-attestation-trust-path\u2468"}],"title":"8.7. None Attestation Statement Format"}],"url":"#attestation-trust-path"},
@@ -11565,10 +11516,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authdata-signcount": {"dfnID":"authdata-signcount","dfnText":"signCount","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-signcount"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-signcount\u2460"},{"id":"ref-for-authdata-signcount\u2461"},{"id":"ref-for-authdata-signcount\u2462"},{"id":"ref-for-authdata-signcount\u2463"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authdata-signcount\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-signcount\u2465"},{"id":"ref-for-authdata-signcount\u2466"},{"id":"ref-for-authdata-signcount\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-signcount"},
 "authentication": {"dfnID":"authentication","dfnText":"Authentication","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication"},{"id":"ref-for-authentication\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authentication\u2462"},{"id":"ref-for-authentication\u2463"},{"id":"ref-for-authentication\u2464"},{"id":"ref-for-authentication\u2465"},{"id":"ref-for-authentication\u2466"},{"id":"ref-for-authentication\u2467"},{"id":"ref-for-authentication\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authentication\u2460\u2460"},{"id":"ref-for-authentication\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication\u2460\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication\u2460\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication\u2460\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authentication\u2460\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authentication\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authentication\u2460\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication\u2460\u2468"}],"title":"16. Acknowledgements"}],"url":"#authentication"},
 "authentication-assertion": {"dfnID":"authentication-assertion","dfnText":"Authentication Assertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-assertion"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authentication-assertion\u2460"},{"id":"ref-for-authentication-assertion\u2461"},{"id":"ref-for-authentication-assertion\u2462"},{"id":"ref-for-authentication-assertion\u2463"},{"id":"ref-for-authentication-assertion\u2464"},{"id":"ref-for-authentication-assertion\u2465"},{"id":"ref-for-authentication-assertion\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-assertion\u2467"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-assertion\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2463"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2464"},{"id":"ref-for-authentication-assertion\u2460\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-assertion\u2460\u2467"}],"title":"13.4.8. Code injection attacks"}],"url":"#authentication-assertion"},
-"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"},{"id":"ref-for-authentication-ceremony\u2463\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"},{"id":"ref-for-authentication-ceremony\u2463\u2465"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"},{"id":"ref-for-authentication-ceremony\u2464\u2462"},{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"},{"id":"ref-for-authentication-ceremony\u2464\u2465"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
-"authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2460"},{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"},{"id":"ref-for-authentication-extension\u2460\u2467"},{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u24ea"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2460"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
+"authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"},{"id":"ref-for-authentication-ceremony\u2460\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"},{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"},{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"},{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"},{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"},{"id":"ref-for-authentication-ceremony\u2462\u2464"},{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"},{"id":"ref-for-authentication-ceremony\u2463\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2464"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2465"},{"id":"ref-for-authentication-ceremony\u2463\u2466"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2467"},{"id":"ref-for-authentication-ceremony\u2463\u2468"},{"id":"ref-for-authentication-ceremony\u2464\u24ea"},{"id":"ref-for-authentication-ceremony\u2464\u2460"},{"id":"ref-for-authentication-ceremony\u2464\u2461"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2462"},{"id":"ref-for-authentication-ceremony\u2464\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2464\u2464"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
+"authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"},{"id":"ref-for-authentication-extension\u2460\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"},{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2467"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
 "authentication-factor-capability": {"dfnID":"authentication-factor-capability","dfnText":"Authentication Factor Capability","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-factor-capability"},{"id":"ref-for-authentication-factor-capability\u2460"},{"id":"ref-for-authentication-factor-capability\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authentication-factor-capability"},
-"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2462"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2464"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u24ea"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2460"},{"id":"ref-for-authenticator\u2462\u2463\u2461"},{"id":"ref-for-authenticator\u2462\u2463\u2462"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2463"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
+"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"},{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"},{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"},{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"},{"id":"ref-for-authenticator\u2460\u2461\u2462"},{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"},{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2461\u2468"},{"id":"ref-for-authenticator\u2461\u2462\u24ea"},{"id":"ref-for-authenticator\u2461\u2462\u2460"},{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"},{"id":"ref-for-authenticator\u2461\u2463\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2461"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"},{"id":"ref-for-authenticator\u2461\u2464\u2464"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"},{"id":"ref-for-authenticator\u2461\u2465\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"},{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"},{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2468"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u24ea"},{"id":"ref-for-authenticator\u2461\u2466\u2460"},{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"},{"id":"ref-for-authenticator\u2461\u2466\u2467"},{"id":"ref-for-authenticator\u2461\u2466\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u24ea"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2460"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2461"},{"id":"ref-for-authenticator\u2461\u2467\u2462"},{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"},{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"},{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2465"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2466"},{"id":"ref-for-authenticator\u2461\u2468\u2467"},{"id":"ref-for-authenticator\u2461\u2468\u2468"},{"id":"ref-for-authenticator\u2462\u24ea\u24ea"},{"id":"ref-for-authenticator\u2462\u24ea\u2460"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2461"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2462"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2463"},{"id":"ref-for-authenticator\u2462\u24ea\u2464"},{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"},{"id":"ref-for-authenticator\u2462\u2460\u2462"},{"id":"ref-for-authenticator\u2462\u2460\u2463"},{"id":"ref-for-authenticator\u2462\u2460\u2464"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2466"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2467"},{"id":"ref-for-authenticator\u2462\u2460\u2468"},{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"},{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2462\u2464"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2465"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"},{"id":"ref-for-authenticator\u2462\u2463\u24ea"},{"id":"ref-for-authenticator\u2462\u2463\u2460"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2463\u2461"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
 "authenticator-attachment-modality": {"dfnID":"authenticator-attachment-modality","dfnText":"Authenticator Attachment Modality","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-attachment-modality"},{"id":"ref-for-authenticator-attachment-modality\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2465"},{"id":"ref-for-authenticator-attachment-modality\u2466"},{"id":"ref-for-authenticator-attachment-modality\u2467"},{"id":"ref-for-authenticator-attachment-modality\u2468"},{"id":"ref-for-authenticator-attachment-modality\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2460\u2460"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-attachment-modality"},
 "authenticator-configuration": {"dfnID":"authenticator-configuration","dfnText":"Authenticator Configuration","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-configuration"},{"id":"ref-for-authenticator-configuration\u2460"},{"id":"ref-for-authenticator-configuration\u2461"},{"id":"ref-for-authenticator-configuration\u2462"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticator-configuration"},
 "authenticator-credentials-map": {"dfnID":"authenticator-credentials-map","dfnText":"credentials map","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-credentials-map"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2461"},{"id":"ref-for-authenticator-credentials-map\u2462"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2463"},{"id":"ref-for-authenticator-credentials-map\u2464"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2465"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2466"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2468"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460\u24ea"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#authenticator-credentials-map"},
@@ -11590,7 +11541,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authenticatorcancel": {"dfnID":"authenticatorcancel","dfnText":"authenticatorCancel","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorcancel"},{"id":"ref-for-authenticatorcancel\u2460"},{"id":"ref-for-authenticatorcancel\u2461"},{"id":"ref-for-authenticatorcancel\u2462"},{"id":"ref-for-authenticatorcancel\u2463"},{"id":"ref-for-authenticatorcancel\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2465"},{"id":"ref-for-authenticatorcancel\u2466"},{"id":"ref-for-authenticatorcancel\u2467"},{"id":"ref-for-authenticatorcancel\u2468"},{"id":"ref-for-authenticatorcancel\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticatorcancel\u2460\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"#authenticatorcancel"},
 "authenticatorgetassertion": {"dfnID":"authenticatorgetassertion","dfnText":"authenticatorGetAssertion","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorgetassertion"},{"id":"ref-for-authenticatorgetassertion\u2460"},{"id":"ref-for-authenticatorgetassertion\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2463"},{"id":"ref-for-authenticatorgetassertion\u2464"},{"id":"ref-for-authenticatorgetassertion\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2468"},{"id":"ref-for-authenticatorgetassertion\u2460\u24ea"},{"id":"ref-for-authenticatorgetassertion\u2460\u2460"},{"id":"ref-for-authenticatorgetassertion\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2462"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2463"},{"id":"ref-for-authenticatorgetassertion\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2460\u2467"},{"id":"ref-for-authenticatorgetassertion\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u24ea"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authenticatorgetassertion\u2461\u2460"},{"id":"ref-for-authenticatorgetassertion\u2461\u2461"}],"title":"11.5. Add Credential"}],"url":"#authenticatorgetassertion"},
 "authenticatorid": {"dfnID":"authenticatorid","dfnText":"authenticatorId","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorid"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticatorid"},
-"authenticatormakecredential": {"dfnID":"authenticatormakecredential","dfnText":"authenticatorMakeCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatormakecredential"},{"id":"ref-for-authenticatormakecredential\u2460"},{"id":"ref-for-authenticatormakecredential\u2461"},{"id":"ref-for-authenticatormakecredential\u2462"},{"id":"ref-for-authenticatormakecredential\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2464"},{"id":"ref-for-authenticatormakecredential\u2465"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2466"},{"id":"ref-for-authenticatormakecredential\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2460"},{"id":"ref-for-authenticatormakecredential\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2462"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2463"},{"id":"ref-for-authenticatormakecredential\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2467"},{"id":"ref-for-authenticatormakecredential\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u2460"},{"id":"ref-for-authenticatormakecredential\u2461\u2461"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticatormakecredential"},
+"authenticatormakecredential": {"dfnID":"authenticatormakecredential","dfnText":"authenticatorMakeCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatormakecredential"},{"id":"ref-for-authenticatormakecredential\u2460"},{"id":"ref-for-authenticatormakecredential\u2461"},{"id":"ref-for-authenticatormakecredential\u2462"},{"id":"ref-for-authenticatormakecredential\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2464"},{"id":"ref-for-authenticatormakecredential\u2465"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2466"},{"id":"ref-for-authenticatormakecredential\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2460"},{"id":"ref-for-authenticatormakecredential\u2460\u2461"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2462"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2463"},{"id":"ref-for-authenticatormakecredential\u2460\u2464"}],"title":"6.3.4. The authenticatorCancel Operation"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2460\u2467"},{"id":"ref-for-authenticatormakecredential\u2460\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u24ea"},{"id":"ref-for-authenticatormakecredential\u2461\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticatormakecredential\u2461\u2461"},{"id":"ref-for-authenticatormakecredential\u2461\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#authenticatormakecredential"},
 "authenticatorresponse": {"dfnID":"authenticatorresponse","dfnText":"AuthenticatorResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorresponse"},{"id":"ref-for-authenticatorresponse\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorresponse\u2461"},{"id":"ref-for-authenticatorresponse\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2463"},{"id":"ref-for-authenticatorresponse\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2465"},{"id":"ref-for-authenticatorresponse\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"#authenticatorresponse"},
 "authorization-gesture": {"dfnID":"authorization-gesture","dfnText":"Authorization Gesture","external":false,"refSections":[{"refs":[{"id":"ref-for-authorization-gesture"}],"title":"1.2.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2460"}],"title":"1.2.2. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2461"},{"id":"ref-for-authorization-gesture\u2462"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2463"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-authorization-gesture\u2464"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2465"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2466"},{"id":"ref-for-authorization-gesture\u2467"},{"id":"ref-for-authorization-gesture\u2468"},{"id":"ref-for-authorization-gesture\u2460\u24ea"},{"id":"ref-for-authorization-gesture\u2460\u2460"},{"id":"ref-for-authorization-gesture\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2462"},{"id":"ref-for-authorization-gesture\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2465"},{"id":"ref-for-authorization-gesture\u2460\u2466"},{"id":"ref-for-authorization-gesture\u2460\u2467"},{"id":"ref-for-authorization-gesture\u2460\u2468"},{"id":"ref-for-authorization-gesture\u2461\u24ea"},{"id":"ref-for-authorization-gesture\u2461\u2460"},{"id":"ref-for-authorization-gesture\u2461\u2461"},{"id":"ref-for-authorization-gesture\u2461\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2463"},{"id":"ref-for-authorization-gesture\u2461\u2464"},{"id":"ref-for-authorization-gesture\u2461\u2465"},{"id":"ref-for-authorization-gesture\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2468"}],"title":"15. Accessibility Considerations"}],"url":"#authorization-gesture"},
 "b05bf85d": {"dfnID":"b05bf85d","dfnText":"buffer source types","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-buffer-source-type"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-buffer-source-type\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
@@ -11622,12 +11573,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "be2d2b4c": {"dfnID":"be2d2b4c","dfnText":"SyntaxError","external":true,"refSections":[{"refs":[{"id":"ref-for-syntaxerror"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#syntaxerror"},
 "biometric-authenticator": {"dfnID":"biometric-authenticator","dfnText":"Biometric Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-biometric-authenticator"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-biometric-authenticator\u2460"},{"id":"ref-for-biometric-authenticator\u2461"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#biometric-authenticator"},
 "biometric-recognition": {"dfnID":"biometric-recognition","dfnText":"Biometric Recognition","external":false,"refSections":[{"refs":[{"id":"ref-for-biometric-recognition"},{"id":"ref-for-biometric-recognition\u2460"},{"id":"ref-for-biometric-recognition\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-biometric-recognition\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-biometric-recognition\u2463"},{"id":"ref-for-biometric-recognition\u2464"},{"id":"ref-for-biometric-recognition\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#biometric-recognition"},
-"bound-credential": {"dfnID":"bound-credential","dfnText":"Bound credential","external":false,"refSections":[{"refs":[{"id":"ref-for-bound-credential\u2460"},{"id":"ref-for-bound-credential\u2461"},{"id":"ref-for-bound-credential\u2462"},{"id":"ref-for-bound-credential\u2463"},{"id":"ref-for-bound-credential\u2464"},{"id":"ref-for-bound-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-bound-credential\u2466"},{"id":"ref-for-bound-credential\u2467"},{"id":"ref-for-bound-credential\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-bound-credential\u2460\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2460"},{"id":"ref-for-bound-credential\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2462"},{"id":"ref-for-bound-credential\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2464"},{"id":"ref-for-bound-credential\u2460\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#bound-credential"},
+"bound-credential": {"dfnID":"bound-credential","dfnText":"Bound credential","external":false,"refSections":[{"refs":[{"id":"ref-for-bound-credential\u2460"},{"id":"ref-for-bound-credential\u2461"},{"id":"ref-for-bound-credential\u2462"},{"id":"ref-for-bound-credential\u2463"},{"id":"ref-for-bound-credential\u2464"},{"id":"ref-for-bound-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-bound-credential\u2466"},{"id":"ref-for-bound-credential\u2467"},{"id":"ref-for-bound-credential\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-bound-credential\u2460\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2460"},{"id":"ref-for-bound-credential\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2462"},{"id":"ref-for-bound-credential\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2465"},{"id":"ref-for-bound-credential\u2460\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#bound-credential"},
 "c15f1628": {"dfnID":"c15f1628","dfnText":"internal slot","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
 "c1f02de3": {"dfnID":"c1f02de3","dfnText":"salt","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
 "c3e881ef": {"dfnID":"c3e881ef","dfnText":"SecurityError","external":true,"refSections":[{"refs":[{"id":"ref-for-securityerror"},{"id":"ref-for-securityerror\u2460"},{"id":"ref-for-securityerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-securityerror\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2463"},{"id":"ref-for-securityerror\u2464"},{"id":"ref-for-securityerror\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-securityerror\u2466"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2467"},{"id":"ref-for-securityerror\u2468"},{"id":"ref-for-securityerror\u2460\u24ea"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-securityerror\u2460\u2460"},{"id":"ref-for-securityerror\u2460\u2461"},{"id":"ref-for-securityerror\u2460\u2462"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-securityerror\u2460\u2463"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-securityerror\u2460\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#securityerror"},
 "c63519ed": {"dfnID":"c63519ed","dfnText":"top-level origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-environment-top-level-origin"},{"id":"ref-for-concept-environment-top-level-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
-"c88f3887": {"dfnID":"c88f3887","dfnText":"item (for struct)","external":true,"refSections":[{"refs":[{"id":"ref-for-struct-item"},{"id":"ref-for-struct-item\u2460"},{"id":"ref-for-struct-item\u2461"},{"id":"ref-for-struct-item\u2462"},{"id":"ref-for-struct-item\u2463"},{"id":"ref-for-struct-item\u2464"},{"id":"ref-for-struct-item\u2465"},{"id":"ref-for-struct-item\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct-item\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2460\u24ea"},{"id":"ref-for-struct-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct-item\u2460\u2461"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"https://infra.spec.whatwg.org/#struct-item"},
+"c88f3887": {"dfnID":"c88f3887","dfnText":"item (for struct)","external":true,"refSections":[{"refs":[{"id":"ref-for-struct-item"},{"id":"ref-for-struct-item\u2460"},{"id":"ref-for-struct-item\u2461"},{"id":"ref-for-struct-item\u2462"},{"id":"ref-for-struct-item\u2463"},{"id":"ref-for-struct-item\u2464"},{"id":"ref-for-struct-item\u2465"},{"id":"ref-for-struct-item\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct-item\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct-item\u2460\u24ea"},{"id":"ref-for-struct-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct-item\u2460\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"https://infra.spec.whatwg.org/#struct-item"},
 "ca3ca4ae": {"dfnID":"ca3ca4ae","dfnText":"URL parser","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-parser"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://url.spec.whatwg.org/#concept-url-parser"},
 "cb9acc83": {"dfnID":"cb9acc83","dfnText":"set a property","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-set-a-property"},{"id":"ref-for-dfn-set-a-property\u2460"},{"id":"ref-for-dfn-set-a-property\u2461"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://w3c.github.io/webdriver/#dfn-set-a-property"},
 "cbdc89b4": {"dfnID":"cbdc89b4","dfnText":"while","external":true,"refSections":[{"refs":[{"id":"ref-for-iteration-while"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-iteration-while\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://infra.spec.whatwg.org/#iteration-while"},
@@ -11641,7 +11592,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "cece9985": {"dfnID":"cece9985","dfnText":"kty","external":true,"refSections":[{"refs":[{"id":"ref-for-name-cose-key-common-parameters"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
 "ceremony": {"dfnID":"ceremony","dfnText":"Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-ceremony"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-ceremony\u2460"},{"id":"ref-for-ceremony\u2461"},{"id":"ref-for-ceremony\u2462"},{"id":"ref-for-ceremony\u2463"},{"id":"ref-for-ceremony\u2464"},{"id":"ref-for-ceremony\u2465"},{"id":"ref-for-ceremony\u2466"},{"id":"ref-for-ceremony\u2467"},{"id":"ref-for-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ceremony\u2460\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-ceremony\u2460\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2465"},{"id":"ref-for-ceremony\u2460\u2466"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-ceremony\u2460\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#ceremony"},
 "cfc67fdc": {"dfnID":"cfc67fdc","dfnText":"empty host","external":true,"refSections":[{"refs":[{"id":"ref-for-empty-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-empty-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"https://url.spec.whatwg.org/#empty-host"},
-"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-client\u2463\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client\u2463\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client\u2463\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"},{"id":"ref-for-client\u2463\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2464"},{"id":"ref-for-client\u2464\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2466"},{"id":"ref-for-client\u2464\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"},{"id":"ref-for-client\u2465\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"},{"id":"ref-for-client\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"},{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"},{"id":"ref-for-client\u2466\u24ea"},{"id":"ref-for-client\u2466\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2466\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2466\u2463"},{"id":"ref-for-client\u2466\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2466"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2467"},{"id":"ref-for-client\u2466\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2467\u24ea"},{"id":"ref-for-client\u2467\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2467\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"},{"id":"ref-for-client\u2467\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2467"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2468"},{"id":"ref-for-client\u2468\u24ea"},{"id":"ref-for-client\u2468\u2460"},{"id":"ref-for-client\u2468\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2468\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2468\u2464"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u2465"},{"id":"ref-for-client\u2468\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"},{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2464"},{"id":"ref-for-client\u2460\u24ea\u2465"},{"id":"ref-for-client\u2460\u24ea\u2466"},{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u2460\u24ea"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"},{"id":"ref-for-client\u2460\u2460\u2465"},{"id":"ref-for-client\u2460\u2460\u2466"},{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2461\u24ea"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2460"},{"id":"ref-for-client\u2460\u2461\u2461"},{"id":"ref-for-client\u2460\u2461\u2462"},{"id":"ref-for-client\u2460\u2461\u2463"},{"id":"ref-for-client\u2460\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2465"},{"id":"ref-for-client\u2460\u2461\u2466"},{"id":"ref-for-client\u2460\u2461\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2468"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2462\u24ea"},{"id":"ref-for-client\u2460\u2462\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2462\u2461"}],"title":"14.5. Privacy considerations for clients"},{"refs":[{"id":"ref-for-client\u2460\u2462\u2462"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#client"},
+"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-client\u2463\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-client\u2463\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-client\u2463\u2463"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"},{"id":"ref-for-client\u2463\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2464\u24ea"},{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2464"},{"id":"ref-for-client\u2464\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2466"},{"id":"ref-for-client\u2464\u2467"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"},{"id":"ref-for-client\u2465\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"},{"id":"ref-for-client\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"},{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"},{"id":"ref-for-client\u2466\u24ea"},{"id":"ref-for-client\u2466\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2466\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2466\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2466\u2463"},{"id":"ref-for-client\u2466\u2464"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2466"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2467"},{"id":"ref-for-client\u2466\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2467\u24ea"},{"id":"ref-for-client\u2467\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2467\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"},{"id":"ref-for-client\u2467\u2466"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2467"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2468"},{"id":"ref-for-client\u2468\u24ea"},{"id":"ref-for-client\u2468\u2460"},{"id":"ref-for-client\u2468\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2468\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2468\u2464"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u2465"},{"id":"ref-for-client\u2468\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"},{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"},{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2465"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2466"},{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"},{"id":"ref-for-client\u2460\u2461\u24ea"},{"id":"ref-for-client\u2460\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2461"},{"id":"ref-for-client\u2460\u2461\u2462"},{"id":"ref-for-client\u2460\u2461\u2463"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2464"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2465"},{"id":"ref-for-client\u2460\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2467"}],"title":"14.5. Privacy considerations for clients"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2468"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#client"},
 "client-data": {"dfnID":"client-data","dfnText":"client data","external":false,"refSections":[{"refs":[{"id":"ref-for-client-data"},{"id":"ref-for-client-data\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-client-data\u2461"},{"id":"ref-for-client-data\u2462"},{"id":"ref-for-client-data\u2463"},{"id":"ref-for-client-data\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-data\u2465"},{"id":"ref-for-client-data\u2466"},{"id":"ref-for-client-data\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-data\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-data\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-data\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2461"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-data\u2460\u2463"},{"id":"ref-for-client-data\u2460\u2464"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#client-data"},
 "client-device": {"dfnID":"client-device","dfnText":"Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-client-device"},{"id":"ref-for-client-device\u2460"},{"id":"ref-for-client-device\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-client-device\u2462"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-device\u2463"},{"id":"ref-for-client-device\u2464"},{"id":"ref-for-client-device\u2465"},{"id":"ref-for-client-device\u2466"},{"id":"ref-for-client-device\u2467"},{"id":"ref-for-client-device\u2468"},{"id":"ref-for-client-device\u2460\u24ea"},{"id":"ref-for-client-device\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-device\u2460\u2461"},{"id":"ref-for-client-device\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2463"},{"id":"ref-for-client-device\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2465"},{"id":"ref-for-client-device\u2460\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client-device\u2460\u2467"},{"id":"ref-for-client-device\u2460\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client-device\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-client-device\u2461\u2460"},{"id":"ref-for-client-device\u2461\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-device\u2461\u2462"},{"id":"ref-for-client-device\u2461\u2463"},{"id":"ref-for-client-device\u2461\u2464"},{"id":"ref-for-client-device\u2461\u2465"},{"id":"ref-for-client-device\u2461\u2466"},{"id":"ref-for-client-device\u2461\u2467"},{"id":"ref-for-client-device\u2461\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-device\u2462\u24ea"},{"id":"ref-for-client-device\u2462\u2460"},{"id":"ref-for-client-device\u2462\u2461"},{"id":"ref-for-client-device\u2462\u2462"},{"id":"ref-for-client-device\u2462\u2463"},{"id":"ref-for-client-device\u2462\u2464"},{"id":"ref-for-client-device\u2462\u2465"},{"id":"ref-for-client-device\u2462\u2466"},{"id":"ref-for-client-device\u2462\u2467"},{"id":"ref-for-client-device\u2462\u2468"},{"id":"ref-for-client-device\u2463\u24ea"},{"id":"ref-for-client-device\u2463\u2460"},{"id":"ref-for-client-device\u2463\u2461"},{"id":"ref-for-client-device\u2463\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2464"},{"id":"ref-for-client-device\u2463\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-client-device\u2463\u2466"},{"id":"ref-for-client-device\u2463\u2467"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#client-device"},
 "client-extension": {"dfnID":"client-extension","dfnText":"client extension","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-client-extension\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension\u2466"}],"title":"10.1. Client Extensions"},{"refs":[{"id":"ref-for-client-extension\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-extension\u2468"},{"id":"ref-for-client-extension\u2460\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-client-extension\u2460\u2462"},{"id":"ref-for-client-extension\u2460\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#client-extension"},
@@ -11668,16 +11619,17 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "credential-key-pair": {"dfnID":"credential-key-pair","dfnText":"Credential Key Pair","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-key-pair"},{"id":"ref-for-credential-key-pair\u2460"},{"id":"ref-for-credential-key-pair\u2461"},{"id":"ref-for-credential-key-pair\u2462"},{"id":"ref-for-credential-key-pair\u2463"},{"id":"ref-for-credential-key-pair\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-key-pair\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-key-pair"},
 "credential-parameters": {"dfnID":"credential-parameters","dfnText":"Credential Parameters","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-parameters"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-parameters\u2460"},{"id":"ref-for-credential-parameters\u2461"}],"title":"11.6. Get Credentials"}],"url":"#credential-parameters"},
 "credential-private-key": {"dfnID":"credential-private-key","dfnText":"Credential Private Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-private-key"},{"id":"ref-for-credential-private-key\u2460"},{"id":"ref-for-credential-private-key\u2461"},{"id":"ref-for-credential-private-key\u2462"},{"id":"ref-for-credential-private-key\u2463"},{"id":"ref-for-credential-private-key\u2464"},{"id":"ref-for-credential-private-key\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-private-key\u2466"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-credential-private-key\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-credential-private-key\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u24ea"},{"id":"ref-for-credential-private-key\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2461"},{"id":"ref-for-credential-private-key\u2460\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2463"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2466"},{"id":"ref-for-credential-private-key\u2460\u2467"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-private-key\u2460\u2468"},{"id":"ref-for-credential-private-key\u2461\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-credential-private-key\u2461\u2460"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#credential-private-key"},
-"credential-properties": {"dfnID":"credential-properties","dfnText":"Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-properties"},{"id":"ref-for-credential-properties\u2460"},{"id":"ref-for-credential-properties\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-properties\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-properties\u2463"},{"id":"ref-for-credential-properties\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-credential-properties\u2465"},{"id":"ref-for-credential-properties\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-properties\u2467"},{"id":"ref-for-credential-properties\u2468"},{"id":"ref-for-credential-properties\u2460\u24ea"},{"id":"ref-for-credential-properties\u2460\u2460"},{"id":"ref-for-credential-properties\u2460\u2461"}],"title":"11.10. Set Credential Properties"}],"url":"#credential-properties"},
+"credential-properties": {"dfnID":"credential-properties","dfnText":"Credential Properties","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-properties"},{"id":"ref-for-credential-properties\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-properties\u2461"},{"id":"ref-for-credential-properties\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-credential-properties\u2463"},{"id":"ref-for-credential-properties\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-credential-properties\u2465"},{"id":"ref-for-credential-properties\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-credential-properties\u2467"},{"id":"ref-for-credential-properties\u2468"},{"id":"ref-for-credential-properties\u2460\u24ea"},{"id":"ref-for-credential-properties\u2460\u2460"},{"id":"ref-for-credential-properties\u2460\u2461"}],"title":"11.10. Set Credential Properties"}],"url":"#credential-properties"},
 "credential-public-key": {"dfnID":"credential-public-key","dfnText":"Credential Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-public-key"},{"id":"ref-for-credential-public-key\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-credential-public-key\u2461"},{"id":"ref-for-credential-public-key\u2462"},{"id":"ref-for-credential-public-key\u2463"},{"id":"ref-for-credential-public-key\u2464"},{"id":"ref-for-credential-public-key\u2465"},{"id":"ref-for-credential-public-key\u2466"},{"id":"ref-for-credential-public-key\u2467"},{"id":"ref-for-credential-public-key\u2468"},{"id":"ref-for-credential-public-key\u2460\u24ea"},{"id":"ref-for-credential-public-key\u2460\u2460"},{"id":"ref-for-credential-public-key\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2462"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-credential-public-key\u2460\u2463"},{"id":"ref-for-credential-public-key\u2460\u2464"},{"id":"ref-for-credential-public-key\u2460\u2465"},{"id":"ref-for-credential-public-key\u2460\u2466"},{"id":"ref-for-credential-public-key\u2460\u2467"},{"id":"ref-for-credential-public-key\u2460\u2468"},{"id":"ref-for-credential-public-key\u2461\u24ea"},{"id":"ref-for-credential-public-key\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2461"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2463"},{"id":"ref-for-credential-public-key\u2461\u2464"},{"id":"ref-for-credential-public-key\u2461\u2465"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-credential-public-key\u2461\u2466"},{"id":"ref-for-credential-public-key\u2461\u2467"},{"id":"ref-for-credential-public-key\u2461\u2468"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u24ea"},{"id":"ref-for-credential-public-key\u2462\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2462"},{"id":"ref-for-credential-public-key\u2462\u2463"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2464"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2465"},{"id":"ref-for-credential-public-key\u2462\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-credential-public-key\u2462\u2468"},{"id":"ref-for-credential-public-key\u2463\u24ea"},{"id":"ref-for-credential-public-key\u2463\u2460"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}],"url":"#credential-public-key"},
-"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"},{"id":"ref-for-credential-record\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"},{"id":"ref-for-credential-record\u2468"},{"id":"ref-for-credential-record\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-record\u2460\u2460"},{"id":"ref-for-credential-record\u2460\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2460\u2462"},{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"},{"id":"ref-for-credential-record\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-credential-record\u2460\u2467"},{"id":"ref-for-credential-record\u2460\u2468"},{"id":"ref-for-credential-record\u2461\u24ea"},{"id":"ref-for-credential-record\u2461\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#credential-record"},
+"credential-record": {"dfnID":"credential-record","dfnText":"Credential Record","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-record"},{"id":"ref-for-credential-record\u2460"},{"id":"ref-for-credential-record\u2461"},{"id":"ref-for-credential-record\u2462"},{"id":"ref-for-credential-record\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credential-record\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-credential-record\u2465"},{"id":"ref-for-credential-record\u2466"},{"id":"ref-for-credential-record\u2467"},{"id":"ref-for-credential-record\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-credential-record\u2460\u24ea"},{"id":"ref-for-credential-record\u2460\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-credential-record\u2460\u2461"},{"id":"ref-for-credential-record\u2460\u2462"},{"id":"ref-for-credential-record\u2460\u2463"},{"id":"ref-for-credential-record\u2460\u2464"},{"id":"ref-for-credential-record\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#credential-record"},
 "credential-storage-modality": {"dfnID":"credential-storage-modality","dfnText":"credential storage\nmodality","external":false,"refSections":[{"refs":[{"id":"ref-for-credential-storage-modality"},{"id":"ref-for-credential-storage-modality\u2460"},{"id":"ref-for-credential-storage-modality\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#credential-storage-modality"},
 "credentialcreationdata-attestationconveyancepreferenceoption": {"dfnID":"credentialcreationdata-attestationconveyancepreferenceoption","dfnText":"attestationConveyancePreferenceOption","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationconveyancepreferenceoption"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-attestationconveyancepreferenceoption"},
 "credentialcreationdata-attestationobjectresult": {"dfnID":"credentialcreationdata-attestationobjectresult","dfnText":"attestationObjectResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-attestationobjectresult"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2460"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2461"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2462"},{"id":"ref-for-credentialcreationdata-attestationobjectresult\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-attestationobjectresult"},
 "credentialcreationdata-clientdatajsonresult": {"dfnID":"credentialcreationdata-clientdatajsonresult","dfnText":"clientDataJSONResult","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientdatajsonresult"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-clientdatajsonresult"},
-"credentialcreationdata-clientextensionresults": {"dfnID":"credentialcreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"}],"url":"#credentialcreationdata-clientextensionresults"},
+"credentialcreationdata-clientextensionresults": {"dfnID":"credentialcreationdata-clientextensionresults","dfnText":"clientExtensionResults","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-credentialcreationdata-clientextensionresults\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#credentialcreationdata-clientextensionresults"},
+"credentialpropertiesoutput-client-side-discoverable-credential-property": {"dfnID":"credentialpropertiesoutput-client-side-discoverable-credential-property","dfnText":"client-side discoverable credential property","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#credentialpropertiesoutput-client-side-discoverable-credential-property"},
 "credentialpropertiesoutput-resident-key-credential-property": {"dfnID":"credentialpropertiesoutput-resident-key-credential-property","dfnText":"resident key credential property","external":false,"refSections":[{"refs":[{"id":"ref-for-credentialpropertiesoutput-resident-key-credential-property"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credentialpropertiesoutput-resident-key-credential-property"},
-"credprops": {"dfnID":"credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-credprops"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credprops\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-credprops\u2461"},{"id":"ref-for-credprops\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credprops"},
+"credprops": {"dfnID":"credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-credprops"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-credprops\u2460"},{"id":"ref-for-credprops\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#credprops"},
 "cross-platform-attachment": {"dfnID":"cross-platform-attachment","dfnText":"cross-platform attachment","external":false,"refSections":[{"refs":[{"id":"ref-for-cross-platform-attachment"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2461"},{"id":"ref-for-cross-platform-attachment\u2462"},{"id":"ref-for-cross-platform-attachment\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2464"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-cross-platform-attachment\u2465"}],"title":"11.2. Virtual Authenticators"}],"url":"#cross-platform-attachment"},
 "d0140610": {"dfnID":"d0140610","dfnText":"remote","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discovery-remote"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote"},
 "d0b4a948": {"dfnID":"d0b4a948","dfnText":"a promise rejected with","external":true,"refSections":[{"refs":[{"id":"ref-for-a-promise-rejected-with"},{"id":"ref-for-a-promise-rejected-with\u2460"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2461"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2462"},{"id":"ref-for-a-promise-rejected-with\u2463"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-a-promise-rejected-with\u2464"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"https://webidl.spec.whatwg.org/#a-promise-rejected-with"},
@@ -11748,7 +11700,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-authenticationextensionsclientinputs-prf": {"dfnID":"dom-authenticationextensionsclientinputs-prf","dfnText":"prf","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientinputs-prf"},
 "dom-authenticationextensionsclientoutputs-appid": {"dfnID":"dom-authenticationextensionsclientoutputs-appid","dfnText":"appid","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-appid"},
 "dom-authenticationextensionsclientoutputs-appidexclude": {"dfnID":"dom-authenticationextensionsclientoutputs-appidexclude","dfnText":"appidExclude","external":false,"refSections":[],"url":"#dom-authenticationextensionsclientoutputs-appidexclude"},
-"dom-authenticationextensionsclientoutputs-credprops": {"dfnID":"dom-authenticationextensionsclientoutputs-credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-credprops"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-credprops\u2460"},{"id":"ref-for-dom-authenticationextensionsclientoutputs-credprops\u2461"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticationextensionsclientoutputs-credprops"},
+"dom-authenticationextensionsclientoutputs-credprops": {"dfnID":"dom-authenticationextensionsclientoutputs-credprops","dfnText":"credProps","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-credprops"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-authenticationextensionsclientoutputs-credprops"},
 "dom-authenticationextensionsclientoutputs-largeblob": {"dfnID":"dom-authenticationextensionsclientoutputs-largeblob","dfnText":"largeBlob","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-largeblob"},{"id":"ref-for-dom-authenticationextensionsclientoutputs-largeblob\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionsclientoutputs-largeblob"},
 "dom-authenticationextensionsclientoutputs-prf": {"dfnID":"dom-authenticationextensionsclientoutputs-prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsclientoutputs-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-authenticationextensionsclientoutputs-prf"},
 "dom-authenticationextensionslargeblobinputs-read": {"dfnID":"dom-authenticationextensionslargeblobinputs-read","dfnText":"read","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2460"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2461"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2462"},{"id":"ref-for-dom-authenticationextensionslargeblobinputs-read\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticationextensionslargeblobinputs-read"},
@@ -11817,7 +11769,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-collectedclientdata-toporigin": {"dfnID":"dom-collectedclientdata-toporigin","dfnText":"topOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2467"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2468"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2460"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2467"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-toporigin"},
 "dom-collectedclientdata-type": {"dfnID":"dom-collectedclientdata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-type"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2462"},{"id":"ref-for-dom-collectedclientdata-type\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-collectedclientdata-type"},
 "dom-credentialcreationoptions-publickey": {"dfnID":"dom-credentialcreationoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2460"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2461"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2463"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-credentialcreationoptions-publickey"},
-"dom-credentialpropertiesoutput-authenticatordisplayname": {"dfnID":"dom-credentialpropertiesoutput-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2461"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2463"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2464"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2465"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2466"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-credentialpropertiesoutput-authenticatordisplayname"},
 "dom-credentialpropertiesoutput-rk": {"dfnID":"dom-credentialpropertiesoutput-rk","dfnText":"rk","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-rk"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2460"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2461"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2462"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2463"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2464"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2465"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2466"},{"id":"ref-for-dom-credentialpropertiesoutput-rk\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-credentialpropertiesoutput-rk"},
 "dom-credentialrequestoptions-publickey": {"dfnID":"dom-credentialrequestoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2460"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2461"},{"id":"ref-for-dom-credentialrequestoptions-publickey\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-credentialrequestoptions-publickey\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-credentialrequestoptions-publickey"},
 "dom-currentuserdetailsoptions-displayname": {"dfnID":"dom-currentuserdetailsoptions-displayname","dfnText":"displayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-currentuserdetailsoptions-displayname"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"}],"url":"#dom-currentuserdetailsoptions-displayname"},
@@ -11977,7 +11928,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "feac4ab3": {"dfnID":"feac4ab3","dfnText":"same site","external":true,"refSections":[{"refs":[{"id":"ref-for-same-site"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-same-site\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#same-site"},
 "generating-authenticator": {"dfnID":"generating-authenticator","dfnText":"Generating Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-generating-authenticator"},{"id":"ref-for-generating-authenticator\u2460"},{"id":"ref-for-generating-authenticator\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-generating-authenticator\u2462"}],"title":"6.1.3. Credential Backup State"}],"url":"#generating-authenticator"},
 "get-credentials": {"dfnID":"get-credentials","dfnText":"Get Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-get-credentials"}],"title":"11.6. Get Credentials"}],"url":"#get-credentials"},
-"human-palatability": {"dfnID":"human-palatability","dfnText":"Human Palatability","external":false,"refSections":[{"refs":[{"id":"ref-for-human-palatability"},{"id":"ref-for-human-palatability\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-human-palatability\u2461"},{"id":"ref-for-human-palatability\u2462"},{"id":"ref-for-human-palatability\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2464"},{"id":"ref-for-human-palatability\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-human-palatability\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#human-palatability"},
+"human-palatability": {"dfnID":"human-palatability","dfnText":"Human Palatability","external":false,"refSections":[{"refs":[{"id":"ref-for-human-palatability"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-human-palatability\u2460"},{"id":"ref-for-human-palatability\u2461"},{"id":"ref-for-human-palatability\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2463"},{"id":"ref-for-human-palatability\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}],"url":"#human-palatability"},
 "largeblob": {"dfnID":"largeblob","dfnText":"largeBlob","external":false,"refSections":[{"refs":[{"id":"ref-for-largeblob"},{"id":"ref-for-largeblob\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-largeblob\u2461"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-largeblob\u2462"}],"title":"11.5. Add Credential"}],"url":"#largeblob"},
 "multi-device-credential": {"dfnID":"multi-device-credential","dfnText":"multi-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-device-credential"},{"id":"ref-for-multi-device-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-multi-device-credential\u2461"},{"id":"ref-for-multi-device-credential\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-multi-device-credential\u2463"},{"id":"ref-for-multi-device-credential\u2464"},{"id":"ref-for-multi-device-credential\u2465"},{"id":"ref-for-multi-device-credential\u2466"}],"title":"6.1.3. Credential Backup State"}],"url":"#multi-device-credential"},
 "multi-factor-capable": {"dfnID":"multi-factor-capable","dfnText":"multi-factor capable","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-factor-capable"},{"id":"ref-for-multi-factor-capable\u2460"},{"id":"ref-for-multi-factor-capable\u2461"},{"id":"ref-for-multi-factor-capable\u2462"},{"id":"ref-for-multi-factor-capable\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-multi-factor-capable\u2464"},{"id":"ref-for-multi-factor-capable\u2465"}],"title":"6.2.3. Authentication Factor Capability"}],"url":"#multi-factor-capable"},
@@ -11992,9 +11943,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "platform-credential": {"dfnID":"platform-credential","dfnText":"platform credential","external":false,"refSections":[{"refs":[{"id":"ref-for-platform-credential"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-platform-credential\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-platform-credential\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-platform-credential\u2462"},{"id":"ref-for-platform-credential\u2463"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#platform-credential"},
 "prf": {"dfnID":"prf","dfnText":"prf","external":false,"refSections":[{"refs":[{"id":"ref-for-prf"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-prf\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-prf\u2461"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-prf\u2462"}],"title":"11.1.1. Authenticator Extension Capabilities"}],"url":"#prf"},
 "public-key-credential": {"dfnID":"public-key-credential","dfnText":"Public Key Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential\u2461"},{"id":"ref-for-public-key-credential\u2462"},{"id":"ref-for-public-key-credential\u2463"},{"id":"ref-for-public-key-credential\u2464"},{"id":"ref-for-public-key-credential\u2465"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-public-key-credential\u2466"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-public-key-credential\u2467"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2468"},{"id":"ref-for-public-key-credential\u2460\u24ea"},{"id":"ref-for-public-key-credential\u2460\u2460"},{"id":"ref-for-public-key-credential\u2460\u2461"},{"id":"ref-for-public-key-credential\u2460\u2462"},{"id":"ref-for-public-key-credential\u2460\u2463"},{"id":"ref-for-public-key-credential\u2460\u2464"},{"id":"ref-for-public-key-credential\u2460\u2465"},{"id":"ref-for-public-key-credential\u2460\u2466"},{"id":"ref-for-public-key-credential\u2460\u2467"},{"id":"ref-for-public-key-credential\u2460\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u24ea"},{"id":"ref-for-public-key-credential\u2461\u2460"},{"id":"ref-for-public-key-credential\u2461\u2461"},{"id":"ref-for-public-key-credential\u2461\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2465"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2466"},{"id":"ref-for-public-key-credential\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential\u2461\u2468"},{"id":"ref-for-public-key-credential\u2462\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2461"},{"id":"ref-for-public-key-credential\u2462\u2462"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2464"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2466"}],"title":"5.8. Supporting Data Structures"},{"refs":[{"id":"ref-for-public-key-credential\u2462\u2467"},{"id":"ref-for-public-key-credential\u2462\u2468"},{"id":"ref-for-public-key-credential\u2463\u24ea"},{"id":"ref-for-public-key-credential\u2463\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2462"},{"id":"ref-for-public-key-credential\u2463\u2463"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2464"},{"id":"ref-for-public-key-credential\u2463\u2465"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential\u2463\u2466"},{"id":"ref-for-public-key-credential\u2463\u2467"},{"id":"ref-for-public-key-credential\u2463\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2461"},{"id":"ref-for-public-key-credential\u2464\u2462"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2463"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2464"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2467"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-public-key-credential\u2464\u2468"},{"id":"ref-for-public-key-credential\u2465\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2461"},{"id":"ref-for-public-key-credential\u2465\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2463"},{"id":"ref-for-public-key-credential\u2465\u2464"},{"id":"ref-for-public-key-credential\u2465\u2465"},{"id":"ref-for-public-key-credential\u2465\u2466"},{"id":"ref-for-public-key-credential\u2465\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-public-key-credential\u2465\u2468"},{"id":"ref-for-public-key-credential\u2466\u24ea"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2460"},{"id":"ref-for-public-key-credential\u2466\u2461"},{"id":"ref-for-public-key-credential\u2466\u2462"},{"id":"ref-for-public-key-credential\u2466\u2463"},{"id":"ref-for-public-key-credential\u2466\u2464"},{"id":"ref-for-public-key-credential\u2466\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-public-key-credential\u2466\u2467"},{"id":"ref-for-public-key-credential\u2466\u2468"},{"id":"ref-for-public-key-credential\u2467\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-public-key-credential\u2467\u2460"},{"id":"ref-for-public-key-credential\u2467\u2461"},{"id":"ref-for-public-key-credential\u2467\u2462"},{"id":"ref-for-public-key-credential\u2467\u2463"},{"id":"ref-for-public-key-credential\u2467\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#public-key-credential"},
-"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"},{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"},{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"},{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"},{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"},{"id":"ref-for-public-key-credential-source\u2465\u2460"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2461"},{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2464"},{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"},{"id":"ref-for-public-key-credential-source\u2466\u2466"},{"id":"ref-for-public-key-credential-source\u2466\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2460"},{"id":"ref-for-public-key-credential-source\u2467\u2461"},{"id":"ref-for-public-key-credential-source\u2467\u2462"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2465"},{"id":"ref-for-public-key-credential-source\u2467\u2466"},{"id":"ref-for-public-key-credential-source\u2467\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
+"public-key-credential-source": {"dfnID":"public-key-credential-source","dfnText":"Public Key Credential Source","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source"},{"id":"ref-for-public-key-credential-source\u2460"},{"id":"ref-for-public-key-credential-source\u2461"},{"id":"ref-for-public-key-credential-source\u2462"},{"id":"ref-for-public-key-credential-source\u2463"},{"id":"ref-for-public-key-credential-source\u2464"},{"id":"ref-for-public-key-credential-source\u2465"},{"id":"ref-for-public-key-credential-source\u2466"},{"id":"ref-for-public-key-credential-source\u2467"},{"id":"ref-for-public-key-credential-source\u2468"},{"id":"ref-for-public-key-credential-source\u2460\u24ea"},{"id":"ref-for-public-key-credential-source\u2460\u2460"},{"id":"ref-for-public-key-credential-source\u2460\u2461"},{"id":"ref-for-public-key-credential-source\u2460\u2462"},{"id":"ref-for-public-key-credential-source\u2460\u2463"},{"id":"ref-for-public-key-credential-source\u2460\u2464"},{"id":"ref-for-public-key-credential-source\u2460\u2465"},{"id":"ref-for-public-key-credential-source\u2460\u2466"},{"id":"ref-for-public-key-credential-source\u2460\u2467"},{"id":"ref-for-public-key-credential-source\u2460\u2468"},{"id":"ref-for-public-key-credential-source\u2461\u24ea"},{"id":"ref-for-public-key-credential-source\u2461\u2460"},{"id":"ref-for-public-key-credential-source\u2461\u2461"},{"id":"ref-for-public-key-credential-source\u2461\u2462"},{"id":"ref-for-public-key-credential-source\u2461\u2463"},{"id":"ref-for-public-key-credential-source\u2461\u2464"},{"id":"ref-for-public-key-credential-source\u2461\u2465"},{"id":"ref-for-public-key-credential-source\u2461\u2466"},{"id":"ref-for-public-key-credential-source\u2461\u2467"},{"id":"ref-for-public-key-credential-source\u2461\u2468"},{"id":"ref-for-public-key-credential-source\u2462\u24ea"},{"id":"ref-for-public-key-credential-source\u2462\u2460"},{"id":"ref-for-public-key-credential-source\u2462\u2461"},{"id":"ref-for-public-key-credential-source\u2462\u2462"},{"id":"ref-for-public-key-credential-source\u2462\u2463"},{"id":"ref-for-public-key-credential-source\u2462\u2464"},{"id":"ref-for-public-key-credential-source\u2462\u2465"},{"id":"ref-for-public-key-credential-source\u2462\u2466"},{"id":"ref-for-public-key-credential-source\u2462\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source\u2462\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u24ea"},{"id":"ref-for-public-key-credential-source\u2463\u2460"},{"id":"ref-for-public-key-credential-source\u2463\u2461"},{"id":"ref-for-public-key-credential-source\u2463\u2462"},{"id":"ref-for-public-key-credential-source\u2463\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2464"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2465"},{"id":"ref-for-public-key-credential-source\u2463\u2466"},{"id":"ref-for-public-key-credential-source\u2463\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2463\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u24ea"},{"id":"ref-for-public-key-credential-source\u2464\u2460"},{"id":"ref-for-public-key-credential-source\u2464\u2461"},{"id":"ref-for-public-key-credential-source\u2464\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-public-key-credential-source\u2464\u2464"},{"id":"ref-for-public-key-credential-source\u2464\u2465"},{"id":"ref-for-public-key-credential-source\u2464\u2466"},{"id":"ref-for-public-key-credential-source\u2464\u2467"},{"id":"ref-for-public-key-credential-source\u2464\u2468"},{"id":"ref-for-public-key-credential-source\u2465\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2460"},{"id":"ref-for-public-key-credential-source\u2465\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2463"},{"id":"ref-for-public-key-credential-source\u2465\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-public-key-credential-source\u2465\u2467"},{"id":"ref-for-public-key-credential-source\u2465\u2468"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u24ea"},{"id":"ref-for-public-key-credential-source\u2466\u2460"},{"id":"ref-for-public-key-credential-source\u2466\u2461"},{"id":"ref-for-public-key-credential-source\u2466\u2462"},{"id":"ref-for-public-key-credential-source\u2466\u2463"},{"id":"ref-for-public-key-credential-source\u2466\u2464"},{"id":"ref-for-public-key-credential-source\u2466\u2465"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2466"},{"id":"ref-for-public-key-credential-source\u2466\u2467"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2466\u2468"},{"id":"ref-for-public-key-credential-source\u2467\u24ea"},{"id":"ref-for-public-key-credential-source\u2467\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2461"},{"id":"ref-for-public-key-credential-source\u2467\u2462"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-public-key-credential-source\u2467\u2463"},{"id":"ref-for-public-key-credential-source\u2467\u2464"},{"id":"ref-for-public-key-credential-source\u2467\u2465"}],"title":"11.10. Set Credential Properties"}],"url":"#public-key-credential-source"},
 "public-key-credential-source-id": {"dfnID":"public-key-credential-source-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-id"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2461"},{"id":"ref-for-public-key-credential-source-id\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-id\u2466"},{"id":"ref-for-public-key-credential-source-id\u2467"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-id"},
-"public-key-credential-source-managing-authenticator": {"dfnID":"public-key-credential-source-managing-authenticator","dfnText":"managing authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2462"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2463"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2464"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2465"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2466"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2468"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#public-key-credential-source-managing-authenticator"},
+"public-key-credential-source-managing-authenticator": {"dfnID":"public-key-credential-source-managing-authenticator","dfnText":"managing authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2461"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2462"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2463"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2464"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2465"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2466"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2468"},{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}],"url":"#public-key-credential-source-managing-authenticator"},
 "public-key-credential-source-mutable-item": {"dfnID":"public-key-credential-source-mutable-item","dfnText":"mutable item","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-mutable-item"}],"title":"4. Terminology"}],"url":"#public-key-credential-source-mutable-item"},
 "public-key-credential-source-otherui": {"dfnID":"public-key-credential-source-otherui","dfnText":"otherUI","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-otherui"},{"id":"ref-for-public-key-credential-source-otherui\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2461"},{"id":"ref-for-public-key-credential-source-otherui\u2462"}],"title":"5.1.10.4. signalCurrentUserDetails(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-otherui\u2465"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-otherui"},
 "public-key-credential-source-privatekey": {"dfnID":"public-key-credential-source-privatekey","dfnText":"privateKey","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-privatekey"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-privatekey\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-privatekey\u2461"},{"id":"ref-for-public-key-credential-source-privatekey\u2462"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-privatekey"},
@@ -12009,9 +11960,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
 "registrable-origin-label": {"dfnID":"registrable-origin-label","dfnText":"Registrable Origin Label","external":false,"refSections":[{"refs":[{"id":"ref-for-registrable-origin-label"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registrable-origin-label\u2460"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-registrable-origin-label\u2461"},{"id":"ref-for-registrable-origin-label\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"#registrable-origin-label"},
 "registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
-"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"},{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2462"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"},{"id":"ref-for-registration-ceremony\u2461\u2466"},{"id":"ref-for-registration-ceremony\u2461\u2467"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2468"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
+"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
 "registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"},{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
-"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"},{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"},{"id":"ref-for-relying-party\u2460\u2462\u2468"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"},{"id":"ref-for-relying-party\u2460\u2463\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"},{"id":"ref-for-relying-party\u2460\u2463\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2465"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"},{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2465"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"},{"id":"ref-for-relying-party\u2460\u2468\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"},{"id":"ref-for-relying-party\u2461\u2460\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"},{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2461\u2467"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2468"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u24ea"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"},{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"},{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"},{"id":"ref-for-relying-party\u2461\u2468\u2467"},{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"8.2.1. Certificate Requirements for Packed Attestation Statements"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"},{"id":"ref-for-relying-party\u2462\u24ea\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"},{"id":"ref-for-relying-party\u2462\u2460\u24ea"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2460"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"},{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2462\u2468"},{"id":"ref-for-relying-party\u2462\u2463\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2464"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"},{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"},{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"},{"id":"ref-for-relying-party\u2462\u2467\u2468"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u24ea"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"},{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"},{"id":"ref-for-relying-party\u2463\u24ea\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"},{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2463"},{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2460"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"},{"id":"ref-for-relying-party\u2463\u2462\u2463"},{"id":"ref-for-relying-party\u2463\u2462\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2465"},{"id":"ref-for-relying-party\u2463\u2462\u2466"},{"id":"ref-for-relying-party\u2463\u2462\u2467"},{"id":"ref-for-relying-party\u2463\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u2463\u24ea"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2463\u2460"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2463\u2461"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
+"relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"},{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"},{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"},{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"},{"id":"ref-for-relying-party\u2460\u24ea\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"},{"id":"ref-for-relying-party\u2460\u24ea\u2467"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"},{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"},{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"},{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"},{"id":"ref-for-relying-party\u2460\u2463\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"},{"id":"ref-for-relying-party\u2460\u2463\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"},{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"},{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"},{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2462"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2463"},{"id":"ref-for-relying-party\u2460\u2466\u2464"},{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u24ea"},{"id":"ref-for-relying-party\u2460\u2467\u2460"},{"id":"ref-for-relying-party\u2460\u2467\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2463"},{"id":"ref-for-relying-party\u2460\u2467\u2464"},{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2460"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2461"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2462"},{"id":"ref-for-relying-party\u2460\u2468\u2463"},{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2468"},{"id":"ref-for-relying-party\u2461\u24ea\u24ea"},{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"},{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u24ea"},{"id":"ref-for-relying-party\u2461\u2460\u2460"},{"id":"ref-for-relying-party\u2461\u2460\u2461"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"},{"id":"ref-for-relying-party\u2461\u2460\u2464"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"},{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"},{"id":"ref-for-relying-party\u2461\u2461\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2465"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2461\u2468"},{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"},{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"},{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"},{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"},{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"},{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"},{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"},{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"},{"id":"ref-for-relying-party\u2461\u2468\u2468"}],"title":"8.2.1. Certificate Requirements for Packed Attestation Statements"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"},{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"},{"id":"ref-for-relying-party\u2462\u24ea\u2467"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2468"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2464"},{"id":"ref-for-relying-party\u2462\u2460\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"},{"id":"ref-for-relying-party\u2462\u2461\u2466"},{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u24ea"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2460"},{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2462\u2463"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2468"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"},{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2465"},{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"},{"id":"ref-for-relying-party\u2462\u2463\u2468"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"},{"id":"ref-for-relying-party\u2462\u2464\u2466"},{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"},{"id":"ref-for-relying-party\u2462\u2465\u2464"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"},{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"},{"id":"ref-for-relying-party\u2462\u2467\u2460"},{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2463"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"},{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"},{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"},{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2460"},{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"},{"id":"ref-for-relying-party\u2463\u2460\u2463"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2464"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"},{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u24ea"},{"id":"ref-for-relying-party\u2463\u2462\u2460"},{"id":"ref-for-relying-party\u2463\u2462\u2461"},{"id":"ref-for-relying-party\u2463\u2462\u2462"},{"id":"ref-for-relying-party\u2463\u2462\u2463"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2464"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2465"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},
 "remove-all-credentials": {"dfnID":"remove-all-credentials","dfnText":"Remove All Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-all-credentials"}],"title":"11.8. Remove All Credentials"}],"url":"#remove-all-credentials"},
 "remove-credential": {"dfnID":"remove-credential","dfnText":"Remove Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-remove-credential"}],"title":"11.7. Remove Credential"}],"url":"#remove-credential"},
@@ -12517,7 +12468,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#abstract-opdef-asynchronous-rp-id-validation-algorithm": {"displayText":"Asynchronous RP ID validation algorithm","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"Asynchronous RP ID validation algorithm","type":"abstract-op","url":"#abstract-opdef-asynchronous-rp-id-validation-algorithm"},
 "#abstract-opdef-credential-record-attestationclientdatajson": {"displayText":"attestationClientDataJSON","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationClientDataJSON","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationclientdatajson"},
 "#abstract-opdef-credential-record-attestationobject": {"displayText":"attestationObject","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationObject","type":"abstract-op","url":"#abstract-opdef-credential-record-attestationobject"},
-"#abstract-opdef-credential-record-authenticatordisplayname": {"displayText":"authenticatorDisplayName","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorDisplayName","type":"abstract-op","url":"#abstract-opdef-credential-record-authenticatordisplayname"},
 "#abstract-opdef-credential-record-backupeligible": {"displayText":"backupEligible","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupEligible","type":"abstract-op","url":"#abstract-opdef-credential-record-backupeligible"},
 "#abstract-opdef-credential-record-backupstate": {"displayText":"backupState","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"backupState","type":"abstract-op","url":"#abstract-opdef-credential-record-backupstate"},
 "#abstract-opdef-credential-record-id": {"displayText":"id","export":true,"for_":["credential record"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"id","type":"abstract-op","url":"#abstract-opdef-credential-record-id"},
@@ -12652,6 +12602,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#credentialcreationdata-attestationobjectresult": {"displayText":"attestationobjectresult","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"attestationobjectresult","type":"dfn","url":"#credentialcreationdata-attestationobjectresult"},
 "#credentialcreationdata-clientdatajsonresult": {"displayText":"clientdatajsonresult","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientdatajsonresult","type":"dfn","url":"#credentialcreationdata-clientdatajsonresult"},
 "#credentialcreationdata-clientextensionresults": {"displayText":"clientextensionresults","export":true,"for_":["credentialCreationData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"clientextensionresults","type":"dfn","url":"#credentialcreationdata-clientextensionresults"},
+"#credentialpropertiesoutput-client-side-discoverable-credential-property": {"displayText":"client-side discoverable credential property","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"client-side discoverable credential property","type":"dfn","url":"#credentialpropertiesoutput-client-side-discoverable-credential-property"},
 "#credentialpropertiesoutput-resident-key-credential-property": {"displayText":"resident key credential property","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"resident key credential property","type":"dfn","url":"#credentialpropertiesoutput-resident-key-credential-property"},
 "#credprops": {"displayText":"credprops","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"credprops","type":"dfn","url":"#credprops"},
 "#cross-platform-attachment": {"displayText":"cross-platform attachment","export":true,"for_":[],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"cross-platform attachment","type":"dfn","url":"#cross-platform-attachment"},
@@ -12758,7 +12709,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "#dom-collectedclientdata-toporigin": {"displayText":"topOrigin","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"topOrigin","type":"dict-member","url":"#dom-collectedclientdata-toporigin"},
 "#dom-collectedclientdata-type": {"displayText":"type","export":true,"for_":["CollectedClientData"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"type","type":"dict-member","url":"#dom-collectedclientdata-type"},
 "#dom-credentialcreationoptions-publickey": {"displayText":"publicKey","export":true,"for_":["CredentialCreationOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialcreationoptions-publickey"},
-"#dom-credentialpropertiesoutput-authenticatordisplayname": {"displayText":"authenticatorDisplayName","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"authenticatorDisplayName","type":"dict-member","url":"#dom-credentialpropertiesoutput-authenticatordisplayname"},
 "#dom-credentialpropertiesoutput-rk": {"displayText":"rk","export":true,"for_":["CredentialPropertiesOutput"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"rk","type":"dict-member","url":"#dom-credentialpropertiesoutput-rk"},
 "#dom-credentialrequestoptions-publickey": {"displayText":"publicKey","export":true,"for_":["CredentialRequestOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"publicKey","type":"dict-member","url":"#dom-credentialrequestoptions-publickey"},
 "#dom-currentuserdetailsoptions-displayname": {"displayText":"displayName","export":true,"for_":["CurrentUserDetailsOptions"],"level":"3","normative":true,"shortname":"webauthn","spec":"webauthn-3","status":"local","text":"displayName","type":"dict-member","url":"#dom-currentuserdetailsoptions-displayname"},