From ef99b9afebb421dc5810a352aa0cd777757ccc62 Mon Sep 17 00:00:00 2001
From: Matthew Miller <mmiller@duosecurity.com>
Date: Wed, 7 Aug 2024 19:51:50 +0000
Subject: [PATCH] Merge pull request #2047 from w3c/1859-differentiate-errors

SHA: 056ed8b71badb1bd47119032621ab85194177da5
Reason: push, by MasterKale

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 1253 ++++++++++++++++++++++++++++------------------------
 1 file changed, 671 insertions(+), 582 deletions(-)

diff --git a/index.html b/index.html
index 7a4085b03..5b11c695e 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <title>Web Authentication: An API for accessing Public Key Credentials - Level 3</title>
   <meta content="ED" name="w3c-status">
-  <meta content="Bikeshed version c3a8ac783, updated Wed Jul 24 12:20:06 2024 -0700" name="generator">
+  <meta content="Bikeshed version 6270e4735, updated Tue Aug 6 12:12:30 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="49325c8983c688c4526815ee008289aa9f276b1f" name="revision">
+  <meta content="056ed8b71badb1bd47119032621ab85194177da5" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-07-31">31 July 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-08-07">7 August 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1103,12 +1103,17 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
        <ol class="toc">
         <li><a href="#sctn-credentialcreationoptions-extension"><span class="secno">5.1.1</span> <span class="content"><code>CredentialCreationOptions</code> Dictionary Extension</span></a>
         <li><a href="#sctn-credentialrequestoptions-extension"><span class="secno">5.1.2</span> <span class="content"><code>CredentialRequestOptions</code> Dictionary Extension</span></a>
-        <li><a href="#sctn-createCredential"><span class="secno">5.1.3</span> <span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span></a>
+        <li>
+         <a href="#sctn-createCredential"><span class="secno">5.1.3</span> <span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span></a>
+         <ol class="toc">
+          <li><a href="#sctn-create-request-exceptions"><span class="secno">5.1.3.1</span> <span class="content">Create Request Exceptions</span></a>
+         </ol>
         <li>
          <a href="#sctn-getAssertion"><span class="secno">5.1.4</span> <span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span></a>
          <ol class="toc">
           <li><a href="#sctn-discover-from-external-source"><span class="secno">5.1.4.1</span> <span class="content">PublicKeyCredential’s <code><span><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></span></code> Method</span></a>
           <li><a href="#sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2</span> <span class="content"><span class="algorithm" data-algorithm="Issuing a credential request to an authenticator">Issuing a Credential Request to an Authenticator</span></span></a>
+          <li><a href="#sctn-get-request-exceptions"><span class="secno">5.1.4.3</span> <span class="content">Get Request Exceptions</span></a>
          </ol>
         <li><a href="#sctn-storeCredential"><span class="secno">5.1.5</span> <span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span></a>
         <li><a href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.6</span> <span class="content">Availability of <span>User-Verifying Platform Authenticator</span> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span></a>
@@ -2667,7 +2672,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
     </dl>
     <p class="note" role="note"><span class="marker">Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise②">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①①">navigator.credentials.create()</a></code>.</p>
     <p class="note" role="note"><span class="marker">Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -3103,9 +3108,54 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
     <p>During the above process, the user agent SHOULD show some UI to the user to guide them in the process of selecting and
 authorizing an authenticator. When <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑤">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⓪">conditional</a></code>, prominent modal UI should <i>not</i> be shown <i>unless</i> credential creation was previously consented to via means determined by the user agent.</p>
    </div>
+   <h5 class="heading settled" data-level="5.1.3.1" id="sctn-create-request-exceptions"><span class="secno">5.1.3.1. </span><span class="content">Create Request Exceptions</span><a class="self-link" href="#sctn-create-request-exceptions"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> can encounter a number of exceptions from a call to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">navigator.credentials.create()</a></code>.
+Some exceptions can have multiple reasons for why they happened,
+requiring the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①③">WebAuthn Relying Parties</a> to infer the actual reason based on their use of WebAuthn.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Exceptions that can be raised during processing of any <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>,
+including ones defined outside of this specification,
+are not listed here.</p>
+   <p>The following <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code> exceptions can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#aborterror" id="ref-for-aborterror">AbortError</a></code>
+    <dd data-md>
+     <p>The ceremony was cancelled by an <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>.
+See <a href="#sctn-abortoperation">§ 5.6 Abort Operations with AbortSignal</a> and <a href="#sctn-sample-aborting">§ 1.3.4 Aborting Authentication Operations</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror①">ConstraintError</a></code>
+    <dd data-md>
+     <p>Either <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②">residentKey</a></code> was set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> and no available authenticator supported resident keys,
+or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②">userVerification</a></code> was set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required②">required</a></code> and no available authenticator could perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>
+    <dd data-md>
+     <p>The authenticator used in the ceremony recognized an entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①">excludeCredentials</a></code> after the user <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">consented</a> to registering a credential.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>
+    <dd data-md>
+     <p>No entry in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code> had a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code> property of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key③">public-key</a></code>,
+or the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a> did not support any of the signature algorithms specified in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③">pubKeyCredParams</a></code>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a> was not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>,
+or <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> was not equal to or a registrable domain suffix of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a>.
+In the latter case,
+the <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a> does not support <a href="#sctn-related-origins">related origin requests</a> or the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure①">related origins validation procedure</a> failed.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>
+    <dd data-md>
+     <p>A catch-all error covering a wide range of possible reasons,
+including common ones like the user canceling out of the ceremony.
+Some of these causes are documented throughout this spec,
+while others are client-specific.</p>
+   </dl>
+   <p>The following <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-simple-exception" id="ref-for-dfn-simple-exception">simple exceptions</a> can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror①">TypeError</a></code>
+    <dd data-md>
+     <p>The <code><var>options</var></code> argument was not a valid <code><a href="#sctn-credentialcreationoptions-extension">CredentialCreationOptions</a></code> value,
+or the value of <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user③">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code></code> was empty or was longer than 64 bytes.</p>
+   </dl>
    <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> script optionally specifies some criteria
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get({publicKey:..., ...})</a></code> to
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> script optionally specifies some criteria
 to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
 decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑥">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
@@ -3115,9 +3165,9 @@ <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span clas
    <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertions</a>, the <code>PublicKeyCredential.<dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-collectfromcredentialstore-slot"><code>[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</code></dfn></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①①">internal method</a> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot①">Credential.[[CollectFromCredentialStore]]()</a></code>, of returning an empty set.</p>
    <p>In general, the user agent SHOULD show some UI to the user to guide them in selecting and authorizing an authenticator with which
 to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities②">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget①">conditionalGet</a></code> capability
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> SHOULD first use <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities②">getClientCapabilities()</a></code> to check that the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> supports the <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-conditionalget" id="ref-for-dom-clientcapability-conditionalget①">conditionalGet</a></code> capability
 in order to prevent a user-visible error in case this feature is not available.</p>
-   <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>;
+   <p>Any <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
    <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external-source"><span class="secno">5.1.4.1. </span><span class="content">PublicKeyCredential’s <code><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></dfn></code> Method</span><a class="self-link" href="#sctn-discover-from-external-source"></a></h5>
    <div data-link-for-hint="PublicKeyCredential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)">
@@ -3138,7 +3188,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
     </dl>
     <p class="note" role="note"><span class="marker">Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise③">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">navigator.credentials.get()</a></code>.</p>
     <p class="note" role="note"><span class="marker">Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy①">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy①">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -3166,19 +3216,19 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p>Let <var>credentialIdFilter</var> be an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty②">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a>.</p>
        <li data-md>
         <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout">timeout</a></code></code> is present, check if its value lies
-within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> and if not, correct it to the closest value lying within that range.
-Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code></code> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a>-specific default.</p>
+within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a> and if not, correct it to the closest value lying within that range.
+Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code></code> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a>-specific default.</p>
         <p>See the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout①">recommended range and default for a WebAuthn ceremony timeout</a> for guidance on deciding a reasonable range and default for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code></code>.</p>
         <p class="note" role="note"><span class="marker">Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
       </ol>
      <li data-md>
       <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is
-an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
+an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
      <li data-md>
-      <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a>.
-If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>, then throw a
-"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
+      <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a>.
+If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①①">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain③">valid domain</a>, then throw a
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
     such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑤">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
     Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑥">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a> is allowed here. This is for simplification and also is
     in recognition of various issues with using direct IP address identification in concert with
@@ -3197,18 +3247,18 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
            <li data-md>
             <p>Let <var>rpIdRequested</var> be the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid②">rpId</a></code></code></p>
            <li data-md>
-            <p>Run the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure①">related origins validation procedure</a> with arguments <var>callerOrigin</var> and <var>rpIdRequested</var>.
-If the result is <code>false</code>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+            <p>Run the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure②">related origins validation procedure</a> with arguments <var>callerOrigin</var> and <var>rpIdRequested</var>.
+If the result is <code>false</code>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
           </ol>
          <dt data-md>does not support <a href="#sctn-related-origins">related origin requests</a>
          <dd data-md>
-          <p>throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
+          <p>throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑥">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>.</p>
         </dl>
        <dt data-md>is not present
        <dd data-md>
         <p>Set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid③">rpId</a></code></code> to <var>effectiveDomain</var>.</p>
       </dl>
-      <p class="note" role="note"><span class="marker">Note:</span> <var>rpId</var> represents the caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑨">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⓪">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①①">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid④">rpId</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> <var>rpId</var> represents the caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑨">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⓪">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a> unless the caller has explicitly set <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid④">rpId</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code>.</p>
      <li data-md>
       <p>Let <var>clientExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map③">map</a> and let <var>authenticatorExtensions</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map④">map</a>.</p>
      <li data-md>
@@ -3257,11 +3307,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>savedCredentialIds</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
-or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a>.</p>
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
+or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a>.</p>
      <li data-md>
-      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a>.</p>
+      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">authenticator</a>.</p>
      <li data-md>
       <p>Consider the value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints">hints</a></code> and craft the user interface accordingly, as the user-agent sees fit.</p>
      <li data-md>
@@ -3275,7 +3325,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⓪">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑥">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①①">remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
        <dt data-md>If the user exercises a user agent user-interface option to cancel the process,
        <dd data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
        <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal②">signal</a></code></code> is present and <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted③">aborted</a>,
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①②">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑧">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①③">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Then
@@ -3319,7 +3369,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
        <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation④">mediation</a></code></code> is not <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑤">conditional</a></code>, <var>issuedRequests</var> is empty, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">allowCredentials</a></code></code> is not empty,
 and no <var>authenticator</var> will become available for any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑧">public key credentials</a> therein,
        <dd data-md>
-        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
+        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
         <p class="note" role="note"><span class="marker">Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
        <dt data-md>If an <var>authenticator</var> becomes available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①④">client device</a>,
        <dd data-md>
@@ -3362,7 +3412,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①④">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑨">authenticatorCancel</a> operation
 on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①⑥">remove</a> it from <var>issuedRequests</var>.</p>
-          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">Authenticators</a> may return an indication of "the user cancelled the entire operation".
+          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">Authenticators</a> may return an indication of "the user cancelled the entire operation".
 How a user agent manifests this state to users is unspecified.</p>
         </ol>
        <dt data-md>If any <var>authenticator</var> returns an error status,
@@ -3385,13 +3435,13 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
             <p>whose value is the bytes of <var>clientDataJSON</var>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-authenticatordataresult">authenticatorDataResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">authenticator</a>.</p>
+            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-signatureresult">signatureResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
+            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-userhandleresult">userHandleResult</dfn></code>
            <dd data-md>
-            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
+            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
 the returned <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⓪">user handle</a>. Otherwise, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult①">userHandleResult</a> to null.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-clientextensionresults">clientExtensionResults</dfn></code>
            <dd data-md>
@@ -3446,22 +3496,22 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>. In order to prevent information leak that could identify the
-user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a> for details.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>. In order to prevent information leak that could identify the
+user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a> for details.</p>
     </ol>
    </div>
    <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2. </span><span class="content"><dfn class="dfn-paneled algorithm" data-algorithm="Issuing a credential request to an authenticator" data-dfn-for="PublicKeyCredential" data-dfn-type="dfn" data-noexport id="publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</dfn></span><a class="self-link" href="#sctn-issuing-cred-request-to-authenticator"></a></h5>
    <p>This sub-algorithm of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]]()</a></code> encompasses the specific UI context-independent
-steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
+steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
 It is called by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]]()</a></code> from various points depending on which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑤">user mediation</a> the present <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremony</a> is subject to (e.g.: <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⑨">conditional</a></code> mediation).</p>
    <p>This algorithm accepts the following arguments:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-authenticator"><code>authenticator</code></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
+     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"><code>savedCredentialIds</code></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
+     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-pkoptions"><code>pkOptions</code></dfn>
     <dd data-md>
      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions③">PublicKeyCredentialRequestOptions</a></code> object specifying the desired attributes of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑨">public key credential</a> to discover.</p>
@@ -3475,28 +3525,28 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
     <dd data-md>
      <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑧">map</a> containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier③">extension identifiers</a> to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑦">base64url encoding</a> of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑤">client extension processing</a> output for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension②">authenticator extensions</a>.</p>
    </dl>
-   <p>This algorithm returns <code>false</code> if the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> determines that the <var>authenticator</var> is not capable of handling the request, or <code>true</code> if
+   <p>This algorithm returns <code>false</code> if the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> determines that the <var>authenticator</var> is not capable of handling the request, or <code>true</code> if
 the request was issued successfully.</p>
    <p>The steps for <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator②">issuing a credential request to an authenticator</a> are as follows:</p>
    <ol>
     <li data-md>
-     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required②">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a>,
+     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a>,
 return <code>false</code>.</p>
     <li data-md>
      <p>Let <var>userVerification</var> be the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</dfn>, a Boolean value, as
 follows. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification①">userVerification</a></code></code></p>
      <dl class="switch">
-      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code>
+      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>
       <dd data-md>
        <p>Let <var>userVerification</var> be <code>true</code>.</p>
       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred①">preferred</a></code>
       <dd data-md>
        <p>If the <var>authenticator</var></p>
        <dl class="switch">
-        <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a>
+        <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a>
         <dd data-md>
          <p>Let <var>userVerification</var> be <code>true</code>.</p>
-        <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a>
+        <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a>
         <dd data-md>
          <p>Let <var>userVerification</var> be <code>false</code>.</p>
        </dl>
@@ -3514,7 +3564,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
          <p>Let <var>allowCredentialDescriptorList</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a>.</p>
         <li data-md>
          <p>Execute a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑧">client platform</a>-specific procedure to determine which, if any, <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⓪">public key credentials</a> described by <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①">allowCredentials</a></code></code> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⓪">bound</a> to this <var>authenticator</var>, by matching with <var>rpId</var>, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑤">id</a></code></code>,
-and <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code></code>.
+and <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②">type</a></code></code>.
 Set <var>allowCredentialDescriptorList</var> to this filtered list.</p>
         <li data-md>
          <p>If <var>allowCredentialDescriptorList</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑧">is empty</a>, return <code>false</code>.</p>
@@ -3525,7 +3575,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
 value (see <a href="#authenticatorGetAssertion-return-values">here</a> in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> for more information).</p>
         <li data-md>
          <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑥">For each</a> credential descriptor <var>C</var> in <var>allowCredentialDescriptorList</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append③">append</a> each value, if any, of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑦">transports</a></code></code> to <var>distinctTransports</var>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
         <li data-md>
          <p>If <var>distinctTransports</var></p>
          <dl class="switch">
@@ -3554,6 +3604,39 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
     <li data-md>
      <p>Return <code>true</code>.</p>
    </ol>
+   <h5 class="heading settled" data-level="5.1.4.3" id="sctn-get-request-exceptions"><span class="secno">5.1.4.3. </span><span class="content">Get Request Exceptions</span><a class="self-link" href="#sctn-get-request-exceptions"></a></h5>
+   <p><em>This section is not normative.</em></p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> can encounter a number of exceptions from a call to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">navigator.credentials.get()</a></code>.
+Some exceptions can have multiple reasons for why they happened,
+requiring the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Parties</a> to infer the actual reason based on their use of WebAuthn.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> Exceptions that can be raised during processing of any <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>,
+including ones defined outside of this specification,
+are not listed here.</p>
+   <p>The following <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> exceptions can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#aborterror" id="ref-for-aborterror①">AbortError</a></code>
+    <dd data-md>
+     <p>The ceremony was cancelled by an <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller③">AbortController</a></code>.
+See <a href="#sctn-abortoperation">§ 5.6 Abort Operations with AbortSignal</a> and <a href="#sctn-sample-aborting">§ 1.3.4 Aborting Authentication Operations</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑦">SecurityError</a></code>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①④">effective domain</a> was not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain④">valid domain</a>,
+or <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①⓪">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨">id</a></code></code> was not equal to or a registrable domain suffix of the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑤">effective domain</a>.
+In the latter case,
+the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> does not support <a href="#sctn-related-origins">related origin requests</a> or the <a data-link-type="abstract-op" href="#abstract-opdef-related-origins-validation-procedure" id="ref-for-abstract-opdef-related-origins-validation-procedure③">related origins validation procedure</a> failed.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>
+    <dd data-md>
+     <p>A catch-all error covering a wide range of possible reasons,
+including common ones like the user canceling out of the ceremony.
+Some of these causes are documented throughout this spec,
+while others are client-specific.</p>
+   </dl>
+   <p>The following <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-simple-exception" id="ref-for-dfn-simple-exception①">simple exceptions</a> can be raised:</p>
+   <dl>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror②">TypeError</a></code>
+    <dd data-md>
+     <p>The <code><var>options</var></code> argument was not a valid <code><a href="#sctn-credentialrequestoptions-extension">CredentialRequestOptions</a></code> value.</p>
+   </dl>
    <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span class="secno">5.1.5. </span><span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-storeCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)">
     <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-store-slot" id="ref-for-dom-credential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a></code> method is not supported
@@ -3572,13 +3655,13 @@ <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span c
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code>.</p>
     </ol>
    </div>
    <h4 class="heading settled" data-level="5.1.6" id="sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.6. </span><span class="content">Availability of <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator②">User-Verifying Platform Authenticator</a> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span><a class="self-link" href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"></a></h4>
    <div data-link-for-hint="WebAuthentication/isUserVerifyingPlatformAuthenticatorAvailable">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①③">WebAuthn Relying Parties</a> use this method to determine whether they can create a new credential using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator③">user-verifying platform authenticator</a>.
-Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Parties</a> use this method to determine whether they can create a new credential using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator③">user-verifying platform authenticator</a>.
+Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
 If any are discovered, the promise is resolved with the value of <code>true</code>.
 Otherwise, the promise is resolved with the value of <code>false</code>.
 Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a> can take further actions to guide the user to create a credential.</p>
@@ -3587,12 +3670,12 @@ <h4 class="heading settled" data-level="5.1.6" id="sctn-isUserVerifyingPlatformA
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
 };
 </pre>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
-   <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span><a class="self-link" href="#sctn-getClientCapabilities"></a></h4>
+   <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> capabilities - PublicKeyCredential’s <code>getClientCapabilities()</code> Method</span><a class="self-link" href="#sctn-getClientCapabilities"></a></h4>
    <div data-link-for-hint="WebAuthentication/getClientCapabilities">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to determine the availability of a limited set of <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">client</a> capabilities to offer certain workflows and experiences to users. For example, an RP may offer a sign in button on clients where only <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> transport is available or where <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⓪">conditional</a></code> mediation is unavailable (instead of showing a username field).</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover availablity of these capabilities.</p>
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Parties</a> use this method to determine the availability of a limited set of <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">client</a> capabilities to offer certain workflows and experiences to users. For example, an RP may offer a sign in button on clients where only <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> transport is available or where <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⓪">conditional</a></code> mediation is unavailable (instead of showing a username field).</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover availablity of these capabilities.</p>
     <p>This method has no arguments and returns a record of capability keys to Boolean values.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑧"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑥"><c- b>Promise</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-publickeycredentialclientcapabilities" id="ref-for-typedefdef-publickeycredentialclientcapabilities"><c- n>PublicKeyCredentialClientCapabilities</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="getClientCapabilities()" id="dom-publickeycredential-getclientcapabilities"><code><c- g>getClientCapabilities</c-></code></dfn>();
@@ -3608,19 +3691,19 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-getClientCapabilities"><
 When a capability does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">exist</a> as a key, the availability of the client feature is not known.</p>
     <p>The set of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys②">keys</a> SHOULD also contain a key for each <a href="#sctn-extensions">extension</a> implemented by the client, where the key is formed by prefixing the string <code>extension:</code> to the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifier</a>. The associated value for each implemented extension SHOULD be <code>true</code>. If <code>getClientCapabilities()</code> is supported by a client, but an extension is not mapped to the value <code>true</code>, then a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a> MAY assume that client processing steps for that extension will not be carried out by this client and that the extension MAY not be forwarded to the authenticator.</p>
     <p class="note" role="note"><span class="marker">Note:</span> Even if an extension is mapped to <code>true</code>, the authenticator used for any given operation may not support that extension, so <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Parties</a> MUST NOT assume that the authenticator processing steps for that extension will be performed on that basis.</p>
-    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseCreationOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
 identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions④">PublicKeyCredentialCreationOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑨"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑤"><c- n>PublicKeyCredentialCreationOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseCreationOptionsFromJSON(options)" id="dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson①"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseCreationOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
@@ -3658,15 +3741,15 @@ <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFrom
    </div>
    <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9. </span><span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span><a class="self-link" href="#sctn-parseRequestOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseRequestOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
 identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②①">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type①">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑥">PublicKeyCredentialRequestOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson②">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②⓪"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑦"><c- n>PublicKeyCredentialRequestOptions</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseRequestOptionsFromJSON(options)" id="dom-publickeycredential-parserequestoptionsfromjson"><code><c- g>parseRequestOptionsFromJSON</c-></code></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson①"><c- n>PublicKeyCredentialRequestOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseRequestOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parserequestoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
@@ -3684,7 +3767,7 @@ <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJ
 </pre>
    </div>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①④"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
@@ -3695,13 +3778,13 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorResponse" data-dfn-type="attribute" data-export id="dom-authenticatorresponse-clientdatajson"><code>clientDataJSON</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤">ArrayBuffer</a>, readonly</span>
      <dd data-md>
       <p>This attribute contains a <a href="#clientdatajson-serialization">JSON-compatible serialization</a> of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data">client data</a>, the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data③">hash of which</a> is passed to the
-authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
+authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestationresponse"><span class="secno">5.2.1. </span><span class="content">Information About Public Key Credential (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorattestationresponse"><code>AuthenticatorAttestationResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorattestationresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticator</a>'s response to a client’s request
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a>'s response to a client’s request
 for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a>. It contains information about the new credential that can be used to
-identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a> to assess the characteristics of the credential
+identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Party</a> to assess the characteristics of the credential
 during registration.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext②"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed②"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse③"><c- g>AuthenticatorAttestationResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse④"><c- n>AuthenticatorResponse</c-></a> {
@@ -3724,7 +3807,7 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
 tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation
 statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
@@ -3740,13 +3823,13 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⓪">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
    <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
@@ -3760,10 +3843,10 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
    <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>'s response to a client’s request for
-generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>'s response to a client’s request for
+generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
-optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> to a specific transaction.</p>
+optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse④"><c- g>AuthenticatorAssertionResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑥"><c- n>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
@@ -3813,14 +3896,14 @@ <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><
    </div>
    <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoptions"><span class="secno">5.4. </span><span class="content">Options for Credential Creation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialcreationoptions"><code>PublicKeyCredentialCreationOptions</code></dfn>)</span><a class="self-link" href="#dictionary-makecredentialoptions"></a></h3>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑥"><c- g>PublicKeyCredentialCreationOptions</c-></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨"><c- g>rp</c-></a>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity"><c- n>PublicKeyCredentialUserEntity</c-></a>       <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialUserEntity" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user③"><c- g>user</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①①"><c- g>rp</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity"><c- n>PublicKeyCredentialUserEntity</c-></a>       <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialUserEntity" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④"><c- g>user</c-></a>;
 
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource②"><c- n>BufferSource</c-></a>                             <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge①"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③"><c- g>pubKeyCredParams</c-></a>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑤"><c- g>pubKeyCredParams</c-></a>;
 
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long②"><c- b>unsigned</c-> <c- b>long</c-></a>                                <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout③"><c- g>timeout</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⓪"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①"><c- g>excludeCredentials</c-></a> = [];
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⓪"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②"><c- g>excludeCredentials</c-></a> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria①"><c- n>AuthenticatorSelectionCriteria</c-></a>               <a class="idl-code" data-link-type="dict-member" data-type="AuthenticatorSelectionCriteria" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑧"><c- g>authenticatorSelection</c-></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①①"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨"><c- b>DOMString</c-></a>>                          <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialcreationoptions-hints" id="ref-for-dom-publickeycredentialcreationoptions-hints①"><c- g>hints</c-></a> = [];
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⓪"><c- b>DOMString</c-></a>                                    <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation③"><c- g>attestation</c-></a> = "none";
@@ -3835,27 +3918,27 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> responsible for the request.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
 should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object②">relevant
-settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
+settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑥">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-user"><code>user</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity①">PublicKeyCredentialUserEntity</a></span>
      <dd data-md>
       <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①⓪">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a></p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a>,
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp①②">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
-      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> signs, along with other data,
+      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a> signs, along with other data,
 when producing an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑦">attestation object</a> for the newly created credential.
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
       <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> supports,
 ordered from most preferred to least preferred.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
-If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation fails.</p>
-      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code> values:</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client④①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
+If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation fails.</p>
+      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code> values:</p>
       <ul>
        <li data-md>
         <p>-8 (Ed25519)</p>
@@ -3868,17 +3951,17 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
       <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> is willing to wait for the call to complete. This is
-treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">client</a>.</p>
+treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client④②">client</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
-This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
-If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client④①">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticator</a>,
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥">id</a></code>).
+This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
+If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client④③">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a>,
 or return an error if that fails.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
-that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation.
+that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
@@ -3890,23 +3973,23 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none②">none</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
       <p>The default value is the empty list, which indicates no preference.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a>.
 For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn Extensions</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity"><span class="secno">5.4.1. </span><span class="content">Public Key Entity Description (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialentity"><code>PublicKeyCredentialEntity</code></dfn>)</span><a class="self-link" href="#dictionary-pkcredentialentity"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
 associated with or <a data-link-type="dfn" href="#scope" id="ref-for-scope①①">scoped</a> to, respectively.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity①"><c- g>PublicKeyCredentialEntity</c-></a> {
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④"><c- g>name</c-></a>;
@@ -3928,13 +4011,13 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
          <li data-md>
           <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④③">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑤">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
        <li data-md>
         <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
-identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client④④">Clients</a> to help users
+identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">Clients</a> to help users
 understand with which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> a credential is associated.</p>
         <p>Examples of suitable values for this identifier include, "alexm", "+14255551234",
 "alex.mueller@example.com", "alex.mueller@example.com (prod-env)",
@@ -3948,12 +4031,12 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
          <li data-md>
           <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑤">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑦">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑧">authenticatorMakeCredential</a> operation.</p>
         </ul>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
       <p>When storing a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> member’s value,
 the value MAY be truncated as described in <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> using a size limit greater than or equal to 64 bytes.</p>
     </dl>
@@ -3961,7 +4044,7 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> attributes when creating a new credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪"><c- g>id</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①②"><c- g>id</c-></a>;
 };
 </pre>
    <div>
@@ -3975,7 +4058,7 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
    <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a> attributes when creating a new
 credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity④"><c- g>PublicKeyCredentialUserEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity④"><c- n>PublicKeyCredentialEntity</c-></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥"><c- g>id</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦"><c- g>id</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④"><c- g>displayName</c-></a>;
 };
 </pre>
@@ -3987,7 +4070,7 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
 A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence②">byte sequence</a> with a maximum size of 64 bytes,
 and is not meant to be displayed to the user.</p>
       <p>To ensure secure operation, authentication and authorization
-decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
+decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑥">user handle</a> MUST NOT contain personally identifying information about the user, such as a username or e-mail address;
 see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a> for details. The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> MUST NOT be empty.</p>
       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user accounts</a>,
@@ -4009,52 +4092,52 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
        <li data-md>
         <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑦">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+        <p><a data-link-type="dfn" href="#client" id="ref-for-client④⑨">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value prior to displaying a non-empty value to the user or
 including a non-empty value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
       <p>When storing a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code> member’s value,
 the value MAY be truncated as described in <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> using a size limit greater than or equal to 64 bytes.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelection"><span class="secno">5.4.4. </span><span class="content">Authenticator Selection Criteria (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorselectioncriteria"><code>AuthenticatorSelectionCriteria</code></dfn>)</span><a class="self-link" href="#dictionary-authenticatorSelection"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
 attributes.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria④"><c- g>AuthenticatorSelectionCriteria</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②"><c- g>residentKey</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③"><c- g>residentKey</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②"><c- g>userVerification</c-></a> = "preferred";
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③"><c- g>userVerification</c-></a> = "preferred";
 };
 </pre>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④">DOMString</a></span>
      <dd data-md>
-      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
+      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
 If this member is absent, then any attachment modality is acceptable.
 The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values,
 treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>.</p>
       <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code>,
 which can tell what <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑤">authenticator attachment modality</a> was used
-in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation.</p>
+in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> operation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
-      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③">residentKey</a></code>'s values and semantics.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code>'s values and semantics.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④">required</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> operation.
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> operation.
 The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>.</p>
-      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③">userVerification</a></code>'s values and semantics.</p>
+      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -4074,12 +4157,12 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
    <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options,
 sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred②"><c- s>"preferred"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required④"><c- s>"required"</c-></a>
+    <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤"><c- s>"required"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
@@ -4089,23 +4172,23 @@ <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement">
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
       <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
-For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
+For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
    <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops③">Credential Properties Extension</a>.
-This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
+This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference②"><c- g>AttestationConveyancePreference</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③"><c- s>"none"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect①"><c- s>"indirect"</c-></a>,
@@ -4118,23 +4201,23 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a>.
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a>.
 The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
 in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
       <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> through unmodified.</p>
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
       <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
@@ -4142,37 +4225,37 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> with the data it needs to generate
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code> with the data it needs to generate
 an assertion. Its <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge①">challenge</a></code> member MUST be present, while its other members are OPTIONAL.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑨"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑥"><c- n>BufferSource</c-></a>                <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge②"><c- g>challenge</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long④"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout③"><c- g>timeout</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤"><c- g>rpId</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦"><c- b>DOMString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤"><c- g>rpId</c-></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①③"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑦"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤"><c- g>allowCredentials</c-></a> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②"><c- g>userVerification</c-></a> = "preferred";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints①"><c- g>hints</c-></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②"><c- g>userVerification</c-></a> = "preferred";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints①"><c- g>hints</c-></a> = [];
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs②"><c- n>AuthenticationExtensionsClientInputs</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsClientInputs" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions③"><c- g>extensions</c-></a>;
 };
 </pre>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑦">BufferSource</a></span>
     <dd data-md>
-     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> is willing to wait for the call to complete.
-The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a>.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
+The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a>.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪">DOMString</a></span>
     <dd data-md>
      <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> MUST verify
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> MUST verify
 that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.</p>
      <p>If not specified, its value will
-be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
+be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑦">effective domain</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
+     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
 It can be used in two ways:</p>
      <ul>
       <li data-md>
@@ -4180,41 +4263,41 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
 then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
 This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
        <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
-This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> —
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> will automatically ignore non-eligible credentials
-if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>.</p>
+This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> optimize the user experience for any given situation.
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> —
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> will automatically ignore non-eligible credentials
+if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> to authenticate is not already identified,
 then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
 In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremony</a>,
 and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>,
-the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>,
+the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
      <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
      <p>The list is ordered in descending order of preference: the first item in the list is the most
 preferred credential, and the last is the least preferred.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨">DOMString</a>, defaulting to <code>"preferred"</code></span>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤①">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
-     <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>'s values and semantics.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪">DOMString</a>>, defaulting to <code>[]</code></span>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑥">userVerification</a></code>'s values and semantics.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
      <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints①">PublicKeyCredentialHints</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span class="secno">5.6. </span><span class="content">Abort Operations with <code>AbortSignal</code></span><a class="self-link" href="#sctn-abortoperation"></a></h3>
-   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
+   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller④">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
 See <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section for detailed instructions.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section specifies that web platform APIs integrating with the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller③">AbortController</a></code> must reject the promise immediately once the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortsignal" id="ref-for-abortsignal">AbortSignal</a></code> is <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted④">aborted</a>.
+   <p class="note" role="note"><span class="marker">Note:</span> <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section specifies that web platform APIs integrating with the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller⑤">AbortController</a></code> must reject the promise immediately once the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortsignal" id="ref-for-abortsignal">AbortSignal</a></code> is <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted④">aborted</a>.
     Given the complex inheritance and parallelization structure of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑤">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> methods, the algorithms for the two APIs fulfills this
     requirement by checking the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑤">aborted</a> property in three places. In the case of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑥">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑥">aborted</a> property is checked first in <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-create"><cite>Credential Management 1</cite> § 2.5.4 Create a Credential</a> immediately before calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-create-slot" id="ref-for-dom-credential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a></code>,
     then in <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> right before <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session">authenticator sessions</a> start, and finally
@@ -4226,74 +4309,74 @@ <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span clas
     loses focuses. If a hook is provided, the above paragraph will be updated to include the hook.
     See <a href="https://github.com/whatwg/html/issues/2711">WHATWG HTML WG Issue #2711</a> for more details.</p>
    <h3 class="heading settled" data-level="5.7" id="sctn-extensions-inputs-outputs"><span class="secno">5.7. </span><span class="content">WebAuthn Extensions Inputs and Outputs</span><a class="self-link" href="#sctn-extensions-inputs-outputs"></a></h3>
-   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn extension</a> inputs and outputs.</p>
+   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn extension</a> inputs and outputs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output">Authenticator extension outputs</a> are conveyed as a part of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">authenticator data</a> (see <a href="#table-authData">Table 1</a>).</p>
    <p class="note" role="note"><span class="marker">Note:</span> The types defined below — <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs④">AuthenticationExtensionsClientInputs</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs③">AuthenticationExtensionsClientOutputs</a></code> — are applicable to both <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①">authentication extensions</a>. The "Authentication..." portion of their names should be regarded as meaning "WebAuthentication..."</p>
    <h4 class="heading settled" data-level="5.7.1" id="iface-authentication-extensions-client-inputs"><span class="secno">5.7.1. </span><span class="content">Authentication Extensions Client Inputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑤">AuthenticationExtensionsClientInputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-inputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputs"><code><c- g>AuthenticationExtensionsClientInputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.2" id="iface-authentication-extensions-client-outputs"><span class="secno">5.7.2. </span><span class="content">Authentication Extensions Client Outputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs④">AuthenticationExtensionsClientOutputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-outputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputs"><code><c- g>AuthenticationExtensionsClientOutputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensions-authenticator-inputs"><span class="secno">5.7.3. </span><span class="content">Authentication Extensions Authenticator Inputs (CDDL type <code>AuthenticationExtensionsAuthenticatorInputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-inputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorInputs = {
   * $$extensionInput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
   * $$extensionOutput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl①">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorOutputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑥">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
    <h3 class="heading settled" data-level="5.8" id="sctn-supporting-data-structures"><span class="secno">5.8. </span><span class="content">Supporting Data Structures</span><a class="self-link" href="#sctn-supporting-data-structures"></a></h3>
    <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
 follows.</p>
    <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span class="secno">5.8.1. </span><span class="content">Client Data Used in <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature">WebAuthn Signatures</a> (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-collectedclientdata"><code>CollectedClientData</code></dfn>)</span><a class="self-link" href="#dictionary-client-data"></a></h4>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a>. It is a key-value
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a>. It is a key-value
 mapping whose keys are strings. Values can be any type that has a valid encoding in JSON. Its structure is defined by the
 following Web IDL.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata②">CollectedClientData</a></code> may be extended in the future. Therefore it’s critical when parsing to be tolerant of unknown keys and of any reordering of the keys. See also <a href="#clientdatajson-verification">§ 5.8.1.2 Limited Verification Algorithm</a>.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata③"><c- g>CollectedClientData</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤①"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin②"><c- g>topOrigin</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑥"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin②"><c- g>topOrigin</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code></dfn> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑥"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
 };
 
 <c- b>enum</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-tokenbindingstatus"><code><c- g>TokenBindingStatus</c-></code></dfn> { <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present"><c- s>"present"</c-></a>, <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-supported" id="ref-for-dom-tokenbindingstatus-supported"><c- s>"supported"</c-></a> };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑦">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a></span>
      <dd data-md>
       <p>This member contains the string "webauthn.create" when creating new credentials, and "webauthn.get" when getting an
 assertion from an existing credential. The purpose of this member is to prevent certain types of signature confusion
 attacks (where an attacker substitutes one legitimate signature for another).</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a></span>
      <dd data-md>
       <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑨">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥①">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> of the requester, as provided to the authenticator by the client, in
 the syntax defined by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-toporigin"><code>topOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⓪">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-toporigin"><code>topOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥②">DOMString</a></span>
      <dd data-md>
       <p>This OPTIONAL member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin③">top-level origin</a> of the requester, in the syntax defined
 by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>. It is set only if the call was made from context that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors③">same-origin with its
@@ -4309,7 +4392,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
       <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥①">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③">DOMString</a></span>
         <dd data-md>
          <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
          <div>
@@ -4323,7 +4406,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
           </dl>
          </div>
          <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥②">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④">DOMString</a></span>
         <dd data-md>
          <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url
 encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a>.</p>
@@ -4503,7 +4586,7 @@ <h5 class="heading settled" data-level="5.8.1.3" id="clientdatajson-development"
    <p>If additional fields are added to <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①②">CollectedClientData</a></code> then verifiers that employ the <a href="#clientdatajson-verification">limited verification algorithm</a> will not be able to consider them until the two algorithms above are updated to include them. Once such an update occurs then the added fields inherit the same limitations as described in the previous paragraph. Such an algorithm update would have to accomodate serializations produced by previous versions. I.e. the verification algorithm would have to handle the fact that a sixth key–value pair may not appear sixth (or at all) if generated by a user agent working from a previous version.</p>
    <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span class="secno">5.8.2. </span><span class="content">Credential Type Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-publickeycredentialtype"><code>PublicKeyCredentialType</code></dfn>)</span><a class="self-link" href="#enum-credentialType"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑤"><c- g>PublicKeyCredentialType</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key③"><c- s>"public-key"</c-></a>
+    <a class="idl-code" data-link-type="enum-value" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key④"><c- s>"public-key"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑥">PublicKeyCredentialType</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
@@ -4515,21 +4598,21 @@ <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span cl
    </div>
    <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descriptor"><span class="secno">5.8.3. </span><span class="content">Credential Descriptor (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialdescriptor"><code>PublicKeyCredentialDescriptor</code></dfn>)</span><a class="self-link" href="#dictionary-credential-descriptor"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑨"><c- g>PublicKeyCredentialDescriptor</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑤"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③"><c- g>type</c-></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑧"><c- n>BufferSource</c-></a>                 <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑥"><c- g>id</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪"><c- g>transports</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪"><c- g>transports</c-></a>;
 };
 </pre>
    <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
-It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a>.</p>
+It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a>,
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a>.</p>
    <p>The <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record①">credential descriptor for a credential record</a> is a subset of the properties of that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a>,
-and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>.</p>
+and mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>.</p>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑤">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
+      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code>.</p>
       <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.
 This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> is semantically distinct.</p>
@@ -4538,12 +4621,12 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
       <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
       <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a>.
 This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥">DOMString</a>></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a>></span>
      <dd data-md>
-      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values.</p>
+      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values.</p>
       <p>This SHOULD be set to the value of the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports①">transports</a> item of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> representing the identified <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>.
 This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
-of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> operation.</p>
+of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code> operation.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="secno">5.8.4. </span><span class="content">Authenticator Transport Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatortransport"><code>AuthenticatorTransport</code></dfn>)</span><a class="self-link" href="#enum-transport"></a></h4>
@@ -4558,28 +4641,28 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport④">AuthenticatorTransport</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">clients</a>. This enumeration
+     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a> can be contacted over removable USB.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a> can be contacted over removable USB.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;nfc&quot;|nfc" id="dom-authenticatortransport-nfc"><code>nfc</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;ble&quot;|ble" id="dom-authenticatortransport-ble"><code>ble</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;smart-card&quot;|smart-card" id="dom-authenticatortransport-smart-card"><code>smart-card</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-authenticatortransport-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;internal&quot;|internal" id="dom-authenticatortransport-internal"><code>internal</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
 i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a>.
 These authenticators are not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑨">client device</a>.</p>
     </dl>
@@ -4607,28 +4690,28 @@ <h4 class="heading settled" data-level="5.8.5" id="sctn-alg-identifier"><span cl
    <p class="note" role="note"><span class="marker">Note:</span> There are many checks neccessary to correctly implement signature verification using these algorithms. One of these is that, when processing uncompressed elliptic-curve points, implementations should check that the point is actually on the curve. This check is highlighted because it’s judged to be at particular risk of falling through the gap between a cryptographic library and other code.</p>
    <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirement"><span class="secno">5.8.6. </span><span class="content">User Verification Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-userverificationrequirement"><code>UserVerificationRequirement</code></dfn>)</span><a class="self-link" href="#enum-userVerificationRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement④"><c- g>UserVerificationRequirement</c-></a> {
-    <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤"><c- s>"required"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑥"><c- s>"required"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred②"><c- s>"preferred"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged②"><c- s>"discouraged"</c-></a>
 };
 </pre>
-   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for some of its operations but not for others, and may use this type to express its
+   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> for some of its operations but not for others, and may use this type to express its
 needs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑤">UserVerificationRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> cannot be performed.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -4642,7 +4725,7 @@ <h4 class="heading settled" data-level="5.8.7" id="enum-clientCapability"><span
     <a class="idl-code" data-link-type="enum-value" href="#dom-clientcapability-relatedorigins" id="ref-for-dom-clientcapability-relatedorigins"><c- s>"relatedOrigins"</c-></a>
 };
 </pre>
-   <p>This enumeration defines a limited set of client capabilities which a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a> may evaluate to offer certain workflows and experiences to users.</p>
+   <p>This enumeration defines a limited set of client capabilities which a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> may evaluate to offer certain workflows and experiences to users.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities③">getClientCapabilities()</a></code> method of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> to obtain a description of available capabilities.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-clientcapability" id="ref-for-enumdef-clientcapability②">ClientCapability</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
@@ -4679,12 +4762,12 @@ <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secn
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints③">PublicKeyCredentialHints</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
+     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
     <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhints-security-key"><code>security-key</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhints-client-device"><code>client-device</code></dfn>
      <dd data-md>
@@ -4692,7 +4775,7 @@ <h4 class="heading settled" data-level="5.8.8" id="enum-hints"><span class="secn
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhints-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -4701,16 +4784,16 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
 the feature-identifier tokens "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-create-feature" id="publickey-credentials-create-feature">publickey-credentials-create</dfn></code>"
 and "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-get-feature" id="publickey-credentials-get-feature">publickey-credentials-get</dfn></code>".
 Their <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlists</a> are both '<code>self</code>'. <a data-link-type="biblio" href="#biblio-permissions-policy" title="Permissions Policy">[Permissions-Policy]</a></p>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②⓪">internal methods</a> does not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer④">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential" id="ref-for-abstract-opdef-create-a-credential">Create a <code>Credential</code></a> and <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operations <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
    <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
 To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span class="secno">5.11. </span><span class="content">Using Web Authentication across related origins</span><a class="self-link" href="#sctn-related-origins"></a></h3>
-   <p>By default, Web Authentication requires that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①④">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to④">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑤">effective domain</a>.</p>
+   <p>By default, Web Authentication requires that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑧">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to④">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑨">effective domain</a>.</p>
    <p>This can make deployment challenging for large environments where multiple country-specific domains are in use (e.g. example.com vs example.co.uk vs example.sg), where alternative or brand domains are required (e.g. myexampletravel.com vs examplecruises.com), and/or where platform as a service providers are used to support mobile apps.</p>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Parties</a> can opt in to allowing <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Clients</a> to enable a credential to be created and used across a limited set of related <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origins</a>.
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Parties</a> can opt in to allowing <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①③">WebAuthn Clients</a> to enable a credential to be created and used across a limited set of related <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origins</a>.
 Such <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> MUST choose a common <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> to use across all ceremonies from related origins.</p>
    <p>A JSON document MUST be hosted at the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a>. The JSON document MUST be returned as follows:</p>
    <ul>
@@ -4746,11 +4829,11 @@ <h4 class="heading settled" data-level="5.11.1" id="sctn-validating-relation-ori
      <p>Fetch the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the RP ID <var>rpIdRequested</var> (i.e., <code>https://<var>rpIdRequested</var>/.well-known/webauthn</code>).</p>
      <ol>
       <li data-md>
-       <p>If the fetch fails, the response does not have a content type of <code>application/json</code>, or does not have a status code (after following redirects) of 200, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑥">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code>.</p>
+       <p>If the fetch fails, the response does not have a content type of <code>application/json</code>, or does not have a status code (after following redirects) of 200, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑧">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code>.</p>
       <li data-md>
-       <p>If the body of the resource is not a valid JSON object, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑦">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code>.</p>
+       <p>If the body of the resource is not a valid JSON object, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑨">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code>.</p>
       <li data-md>
-       <p>If the value of the <var>origins</var> property of the JSON object is missing, or is not an array of strings, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑧">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code>.</p>
+       <p>If the value of the <var>origins</var> property of the JSON object is missing, or is not an array of strings, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①⓪">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑨">DOMException</a></code>.</p>
      </ol>
     <li data-md>
      <p>Let <var>labelsSeen</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a>.</p>
@@ -4760,7 +4843,7 @@ <h4 class="heading settled" data-level="5.11.1" id="sctn-validating-relation-ori
       <li data-md>
        <p>Let <var>url</var> be the result of running the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-parser" id="ref-for-concept-url-parser">URL parser</a> with <var>originItem</var> as the input. If that fails, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
       <li data-md>
-       <p>Let <var>domain</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑥">effective domain</a> of <var>url</var>. If that is null, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑧">continue</a>.</p>
+       <p>Let <var>domain</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②⓪">effective domain</a> of <var>url</var>. If that is null, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑧">continue</a>.</p>
       <li data-md>
        <p>Let <var>label</var> be <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label③">registrable origin label</a> of <var>domain</var>.</p>
       <li data-md>
@@ -4781,9 +4864,9 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
 Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platform</a>, MUST be indistinguishable
 from the behavior specified in <a href="#sctn-api">§ 5 Web Authentication API</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys in Section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api" id="ref-for-authenticator-api">§6. Authenticator API</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
-the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
+the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
 unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
@@ -4820,7 +4903,7 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
      <p>The data processed by the authenticator should be small and easy to interpret in low-level code. In particular, authenticators
 should not have to parse high-level encodings such as JSON.</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
+     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
     <li data-md>
      <p>The design aims to reuse as much as possible of existing encoding formats in order to aid adoption and implementation.</p>
    </ul>
@@ -4828,22 +4911,22 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <ol>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> provides cryptographic
-proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
+proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
 signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a> desired.
 For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="assertion-signature">assertion signature</dfn> is produced when the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑦">authenticatorGetAssertion</a> method is invoked. It represents an
-assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
-in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
-same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a>. It also asserts additional
-information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">user consent</a> was
-provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
+assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to a specific transaction, such as logging
+in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
+same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a>. It also asserts additional
+information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user consent</a> was
+provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
    </ol>
    <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
 The formats of these signatures, as well as the procedures for generating them, are specified below.</p>
    <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span class="secno">6.1. </span><span class="content">Authenticator Data</span><a class="self-link" href="#sctn-authenticator-data"></a></h3>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a>. These bindings are
-controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a>'s assessment of the security properties of the
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticator</a>. These bindings are
+controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
 software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
@@ -4937,20 +5020,20 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②③">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
         present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">authenticator data</a>. </figcaption>
    </figure>
-   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
+   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
 However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a> of a
 credential does not change between operations but instead remains the same for the lifetime of that credential. Secondly, it is
 validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③④">RP ID</a> that
-the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a>.</p>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a> structure</dfn>:</p>
+the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a>.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a> structure</dfn>:</p>
    <ul>
     <li data-md>
      <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash">rpIdHash</a>.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①①">flag</a> SHALL be set if and only if the authenticator performed a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑥">test of user presence</a>.
-The <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①②">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a>.
+The <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①②">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>.
 The <code>RFU</code> bits SHALL be set to zero.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> If the authenticator performed both a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑦">test of user presence</a> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>,
+     <p class="note" role="note"><span class="marker">Note:</span> If the authenticator performed both a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑦">test of user presence</a> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a>,
 possibly combined in a single <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑤">authorization gesture</a>,
 then the authenticator will set both the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up①">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①③">flag</a> and the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①④">flag</a>.</p>
     <li data-md>
@@ -4972,7 +5055,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> constant at zero.</p>
    <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
@@ -5028,27 +5111,27 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
    <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
    <ul>
     <li data-md>
-     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticators</a>:</p>
+     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticators</a>:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registered</a> and/or an account recovery process in place.
-For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registered</a> and/or an account recovery process in place.
+For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
      <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
-to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a>,
-such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
+to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a>,
+such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><span class="secno">6.2. </span><span class="content">Authenticator Taxonomy</span><a class="self-link" href="#sctn-authenticator-taxonomy"></a></h3>
-   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> used.
+   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> used.
 This section defines some terminology for those capabilities, their most important combinations,
 and which use cases those combinations enable.</p>
    <p>For example:</p>
@@ -5060,9 +5143,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
      <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform authenticator</a> is likely the most convenient
 since it’s built directly into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑥">client device</a> rather than being a separate device that the user may have to locate.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> can be used.</p>
+     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> can be used.</p>
     <li data-md>
-     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
+     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
     <li data-md>
      <p>A laptop computer might support connecting to <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⓪">roaming authenticators</a> via USB and Bluetooth,
 while a mobile phone might only support NFC.</p>
@@ -5070,11 +5153,11 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform</a> authenticator,
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform</a> authenticator,
 or in some cases both — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a>.</p>
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a>.</p>
     <li data-md>
-     <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
+     <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
     <li data-md>
      <p>Whether the authenticator is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable②">discoverable credential capable</a> — the <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality">credential storage modality</a>.</p>
    </ul>
@@ -5124,24 +5207,24 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 or on a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a> shared between multiple users.</p>
    <p><a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">User-verifying platform authenticators</a> and <a data-link-type="dfn" href="#first-factor-roaming-authenticator" id="ref-for-first-factor-roaming-authenticator①">first-factor roaming authenticators</a> enable passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication.
 In addition to the proof of possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⓪">credential private key</a>,
-these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
+these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
 which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a>.</p>
    <p>The combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①③">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
 where the user is automatically identified by the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②①">user handle</a> and possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①①">credential private key</a> is used as the only <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⓪">authentication factor</a>.
-This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a>.</p>
+This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">multi-factor</a> authentication, but requires the user to be identified first
 which risks leaking personally identifying information; see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
    </ul>
    <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality②">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
    <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment-modality"><span class="secno">6.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-attachment-modality">Authenticator Attachment Modality</dfn></span><a class="self-link" href="#sctn-authenticator-attachment-modality"></a></h4>
-   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
-and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticators</a> that
+   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
+and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticators</a> that
 are part of the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a> as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-authenticators">platform authenticators</dfn>, while those that are reachable via cross-platform
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
@@ -5155,8 +5238,8 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
    </ul>
    <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticator</a>,
-while <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticator</a>,
+while <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
 would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a>.</p>
    <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
@@ -5166,50 +5249,50 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
    <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> shared between multiple users,
 or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a>;
-and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
+and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
-backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> is lost.</p>
+backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
-     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
+     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> to have unlimited credential storage capacity, since the encrypted <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential sources</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> can use it.</p>
    </ol>
-   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
+   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
    <ul>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
-credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
+credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
 credential capable</dfn>.</p>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
 modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential sources</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
-   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> MAY
-at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">create()</a></code>.</p>
+   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> MAY
+at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code>.</p>
    <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-capability"><span class="secno">6.2.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-factor-capability">Authentication Factor Capability</dfn></span><a class="self-link" href="#sctn-authentication-factor-capability"></a></h4>
    <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication
 ceremony</a>: <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a>, <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">something you know</a> and <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you are</a>. Examples include a physical key, a password,
 and a fingerprint, respectively.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user
-verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> can
-verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> that is
-not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
+   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user
+verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> can
+verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> that is
+not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑥">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
 session to exist at any particular time, or by providing more complicated session management.</p>
    <p>The following operations can be invoked by the client in an authenticator session.</p>
    <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-credid"><span class="secno">6.3.1. </span><span class="content">Lookup Credential Source by Credential ID Algorithm</span><a class="self-link" href="#sctn-op-lookup-credsource-by-credid"></a></h4>
-   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
+   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
      <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> <var>credSource</var>:</p>
@@ -5242,16 +5325,16 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a>.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
      <p>The constant Boolean value <code>true</code>, or <var>FALSE</var> when <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑥">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②③">conditional</a></code> and the user agent previously collected consent from the user.</p>
     <dt data-md><var>requireUserVerification</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
@@ -5263,80 +5346,80 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> based on
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> based on
 the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Check if at least one of the specified combinations of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑨">PublicKeyCredentialType</a></code> and cryptographic parameters in <var>credTypesAndPubKeyAlgs</var> is supported.
-If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" and terminate the operation.</p>
+If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">For each</a> <var>descriptor</var> of <var>excludeCredentialDescriptorList</var>:</p>
      <ol>
       <li data-md>
        <p>If <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑦">id</a></code></code> in this authenticator
-returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code></code> respectively,
-then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user
+returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code></code> respectively,
+then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user
 consent</a> for creating a new credential. The <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test
 of user presence</a>. If the user</p>
        <dl class="switch">
         <dt data-md>confirms consent to create a new credential
         <dd data-md>
-         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>" and terminate the operation.</p>
+         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>" and terminate the operation.</p>
         <dt data-md>does not consent to create a new credential
         <dd data-md>
-         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
+         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①④">NotAllowedError</a></code>" and terminate the operation.</p>
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑧">authorization gesture</a> is not to proceed with creating a credential,
-but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a>.
+but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a>.
 If the user does not consent,
-the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
+the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
      </ol>
     <li data-md>
      <p>If <var>requireResidentKey</var> is <code>true</code> and the authenticator cannot store a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑤">client-side discoverable public key credential source</a>,
-return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror①">ConstraintError</a></code>" and terminate the operation.</p>
+return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror②">ConstraintError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>If <var>requireUserVerification</var> is <code>true</code> and the authenticator cannot perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a>, return an error code
-equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror②">ConstraintError</a></code>" and terminate the operation.</p>
+     <p>If <var>requireUserVerification</var> is <code>true</code> and the authenticator cannot perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a>, return an error code
+equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#constrainterror" id="ref-for-constrainterror③">ConstraintError</a></code>" and terminate the operation.</p>
     <li id="op-makecred-step-user-consent">
-     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user consent</a> for creating a new credential.
+     <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">user consent</a> for creating a new credential.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⓪">authorization gesture</a> is shown by the
-    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①②">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code></code>, if possible. 
-     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a>.</p>
+    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①④">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code></code>, if possible. 
+     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑨">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a> fails, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> fails, return an error code equivalent to
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑤">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">user consent</a> has been obtained, generate a new credential object:</p>
+     <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> has been obtained, generate a new credential object:</p>
      <ol>
       <li data-md>
        <p>Let (<var>publicKey</var>, <var>privateKey</var>) be a new pair of cryptographic keys using the combination of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①⓪">PublicKeyCredentialType</a></code> and cryptographic parameters represented by the first <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①⓪">item</a> in <var>credTypesAndPubKeyAlgs</var> that is supported by
 this authenticator.</p>
       <li data-md>
-       <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
+       <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code>.</p>
       <li data-md>
        <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
-         <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key④">public-key</a></code>.</p>
+         <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey">privateKey</a>
         <dd data-md>
          <p><var>privateKey</var></p>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid②">rpId</a>
         <dd data-md>
-         <p><code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code></p>
+         <p><code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⑤">id</a></code></code></p>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle①">userHandle</a>
         <dd data-md>
          <p><var>userHandle</var></p>
@@ -5354,7 +5437,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
         <li data-md>
          <p>Let <var>credentials</var> be this authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credentials map</a>.</p>
         <li data-md>
-         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①④">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
+         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⑥">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
        </ol>
       <li data-md>
        <p>Otherwise:</p>
@@ -5371,7 +5454,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input②">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a>:</p>
+     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a>:</p>
      <dl class="switch">
       <dt data-md>is a U2F device
       <dd data-md>
@@ -5424,7 +5507,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
 the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
-   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
@@ -5446,23 +5529,23 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②⓪">Remove</a> any items from <var>credentialOptions</var> whose <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid③">rpId</a> is not equal to <var>rpId</var>.</p>
     <li data-md>
-     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①④">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑥">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
      <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
-    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
+    Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> may be shown
-    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
-     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a>.</p>
+    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
+     <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①①">test of user presence</a>.</p>
-     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a>, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑤">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">consent</a>, return an error code equivalent to
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⑦">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input④">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
      <p>Increment the credential associated <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⓪">signature counter</a> or the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②①">signature counter</a> value, depending on
-which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a>, by some positive value.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
+which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a>, by some positive value.
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
 zero.</p>
     <li data-md>
      <p>Let <var>authenticatorData</var> <a data-link-type="dfn" href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure" id="ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure①">be the byte array</a> specified in <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a> including <var>processedExtensions</var>, if any, as
@@ -5497,7 +5580,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5511,9 +5594,9 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a>.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a>.</p>
    </dl>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Let <var>collectedDiscoverableCredentialMetadata</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑥">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①①">items</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata">DiscoverableCredentialMetadata</dfn> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct④">structs</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①⓪">items</a>:</p>
@@ -5532,7 +5615,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user handle</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-otherui">otherUI</dfn>
       <dd data-md>
-       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> to inform its UI.</p>
+       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
@@ -5552,7 +5635,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
    <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
-   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a>.
+   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a>.
 When the chosen accommodation is string truncation, care needs to be taken to not corrupt the string value.</p>
    <p>For example, truncation based on Unicode code points alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> to be truncated.
 This could make the grapheme cluster render as a different glyph,
@@ -5565,8 +5648,8 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
      <img src="images/string-truncation.svg"> 
     <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
    </figure>
-   <p>The responsibility for handling these concerns falls primarily on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a>,
-to avoid burdening <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticators</a> with understanding character encodings and Unicode character properties.
+   <p>The responsibility for handling these concerns falls primarily on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a>,
+to avoid burdening <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticators</a> with understanding character encodings and Unicode character properties.
 The following subsections define requirements for how clients and authenticators,
 respectively, may perform string truncation.</p>
    <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-client"><span class="secno">6.4.1.1. </span><span class="content">String Truncation by Clients</span><a class="self-link" href="#sctn-strings-truncation-client"></a></h5>
@@ -5577,9 +5660,9 @@ <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-cli
 This truncation MUST respect UTF-8 code point boundaries, and SHOULD respect <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>.
 The resulting truncated value MAY be shorter than the chosen size limit
 but MUST NOT be shorter than the longest prefix substring that satisfies the size limit and ends on a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> boundary.</p>
-   <p>The client MAY let the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> perform the truncation if it satisfies these requirements;
+   <p>The client MAY let the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> perform the truncation if it satisfies these requirements;
 otherwise the client MUST perform the truncation before relaying the string value to the authenticator.</p>
-   <p>In addition to the above, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticators</a>, user agents SHOULD:</p>
+   <p>In addition to the above, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticators</a>, user agents SHOULD:</p>
    <ol>
     <li data-md>
      <p>Ensure that any strings sent to authenticators are validly encoded.</p>
@@ -5588,7 +5671,7 @@ <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-cli
    </ol>
    <h5 class="heading settled" data-level="6.4.1.2" id="sctn-strings-truncation-authenticator"><span class="secno">6.4.1.2. </span><span class="content">String Truncation by Authenticators</span><a class="self-link" href="#sctn-strings-truncation-authenticator"></a></h5>
    <p>Because a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a> may be implemented in a constrained environment,
-the requirements on authenticators are relaxed compared to those for <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">clients</a>.</p>
+the requirements on authenticators are relaxed compared to those for <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">clients</a>.</p>
    <p>When a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticator</a> truncates a string,
 the truncation behaviour MUST satisfy the following requirements:</p>
    <p>Choose a size limit equal to or greater than the specified minimum supported length.
@@ -5597,7 +5680,7 @@ <h5 class="heading settled" data-level="6.4.1.2" id="sctn-strings-truncation-aut
 The resulting truncated value MAY be shorter than the chosen size limit
 but MUST NOT be shorter than the longest prefix substring that satisfies the size limit and ends on a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster⑤">grapheme cluster</a> boundary.</p>
    <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span class="secno">6.4.2. </span><span class="content">Language and Direction Encoding</span><a class="self-link" href="#sctn-strings-langdir"></a></h4>
-   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
+   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
    <p>To encode language and direction metadata in a string that is documented as permitting it, suffix its code points with two sequences of code points:</p>
    <p>The first encodes a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1①">language tag</a> with the code point U+E0001 followed by the ASCII values of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1②">language tag</a> each shifted up by U+E0000. For example, the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1③">language tag</a> “en-US” becomes the code points U+E0001, U+E0065, U+E006E, U+E002D, U+E0055, U+E0053.</p>
    <p>The second consists of a single code point which is either U+200E (“LEFT-TO-RIGHT MARK”), U+200F (“RIGHT-TO-LEFT MARK”), or U+E007F (“CANCEL TAG”). The first two can be used to indicate directionality but SHOULD only be used when neccessary to produce the correct result. (E.g. an RTL string that starts with LTR-strong characters.) The value U+E007F is a direction-agnostic indication of the end of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1④">language tag</a>.</p>
@@ -5610,16 +5693,16 @@ <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span c
    </ul>
    <p>Consumers of strings that may have language and direction encoded should be aware that truncation could truncate a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1⑤">language tag</a> into a different, but still valid, language. The final directionality marker or CANCEL TAG code point provide an unambigous indication of truncation.</p>
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, if possible.
-If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> can
-produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, if possible.
+If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> can
+produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
 enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a>,
-or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
-   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
+or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
 for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a>.</p>
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
     <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
@@ -5628,14 +5711,14 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③">attestation statement
   formats</a> are defined in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. </div>
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①②">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
-data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a> that created it. It
+data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
 attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation
 statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
-bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a>. In other words, this defines the
+bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>. In other words, this defines the
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format④">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statements</a> and their underlying trust models.
@@ -5653,13 +5736,13 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
      <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestation</a> by limiting what can be
 expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a>, and</p>
     <li data-md>
-     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>, such as its construction, whether part or all of it runs in a secure
+     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
-   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters.</p>
+   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
 formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> will also need to
-understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
+understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data"><span class="secno">6.5.1. </span><span class="content">Attested Credential Data</span><a class="self-link" href="#sctn-attested-credential-data"></a></h4>
    <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
 object</a> for a credential. Its format is shown in <a href="#table-attestedCredentialData">Table <span class="table-ref-following"></span></a>.</p>
@@ -5752,7 +5835,7 @@ <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-exa
 <c- p>}</c->
 </pre>
    <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><span class="secno">6.5.2. </span><span class="content">Attestation Statement Formats</span><a class="self-link" href="#sctn-attestation-formats"></a></h4>
-   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
+   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
 template:</p>
    <ul>
     <li data-md>
@@ -5790,8 +5873,8 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span class="secno">6.5.3. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
    <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
-calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
 section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 24</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
 Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is acceptable
@@ -5809,16 +5892,16 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span
 Authenticators without meaningful protection measures for an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key②">attestation private key</a> typically use this attestation type.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-ca">Attestation CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attca">AttCA</dfn>)
     <dd data-md>
-     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
-"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a> can generate multiple
+     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
+"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
-for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> can limit the exposure of the EK (which is a global correlation
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
@@ -5840,7 +5923,7 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-generating-an-attestatio
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">hash of the serialized client data</a>.</p>
    </dl>
-   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a> MUST:</p>
+   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticator</a> MUST:</p>
    <ol>
     <li data-md>
      <p>Let <var>attStmt</var> be the result of running <var>attestationFormat</var>’s <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure①">signing procedure</a> given <var>authData</var> and <var>hash</var>.</p>
@@ -5876,7 +5959,7 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
     |  4e 72 23 6e a3 90 a9 a1  7b cf 5f 7a 09 d6 3a b2
     |  17 6c 92 bb 8e 36 c0 41  98 a2 7b 90 9b 6e 8f 13
 </pre>
-     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
    </ul>
    <p>It is RECOMMENDED that any new attestation formats defined not use ASN.1 encodings,
     but instead represent signatures as equivalent fixed-length byte arrays without internal structure,
@@ -5892,9 +5975,9 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 RSASSA-PSS signature scheme defined in Section 8.1.1 of <a data-link-type="biblio" href="#biblio-rfc8017" title="PKCS #1: RSA Cryptography Specifications Version 2.2">[RFC8017]</a> with SHA-256 as the hash function.
 The signature is not ASN.1 wrapped.</p>
    </ul>
-   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a>'s script receives
+   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a>'s script receives
 a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
 respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> server, using methods outside
 the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> must perform upon receipt of these
@@ -5905,11 +5988,11 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as
 might be determinable from the context available in the rejected promise. For example if the promise is rejected with
-an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a>.
+an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑤">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a>.
 For information on different error contexts and the circumstances leading to them, see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>.</p>
     <li data-md>
      <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑤">response</a></code></code>.
@@ -5953,7 +6036,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set, unless <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑦">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a> for this registration,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> for this registration,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit is not set.</p>
@@ -5962,7 +6045,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
+     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑥">pubKeyCredParams</a></code></code>.</p>
     <li id="reg-ceremony-verify-extension-outputs">
      <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
@@ -5971,7 +6054,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Parties</a> MUST be prepared to handle such
     situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys①">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-create">§ 10.2.1.3.1 Registration (create())</a>.</p>
     <li data-md>
@@ -6005,7 +6088,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
-    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
+    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code></code>,
     with the following contents: 
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type②">type</a>
@@ -6048,7 +6131,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
      <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
     credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> is asserting there
-    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> model.
+    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
    <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> has a trusted method of determining acceptable trust anchors
@@ -6062,7 +6145,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as might
 be determinable from the context available in the rejected promise. For information on different error contexts and the
@@ -6124,8 +6207,8 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>Determine whether <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> is required for this assertion. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">User verification</a> SHOULD be required if, and only if, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑥">required</a></code>.</p>
-     <p>If <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">user verification</a> was determined to be required,
+     <p>Determine whether <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">user verification</a> is required for this assertion. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">User verification</a> SHOULD be required if, and only if, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑦">required</a></code>.</p>
+     <p>If <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a> was determined to be required,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flags</a></code> in <var>authData</var> is set.
 Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a>.</p>
     <li data-md>
@@ -6152,7 +6235,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
      <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Parties</a> MUST be prepared to handle such
     situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys②">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-get">§ 10.2.1.3.2 Authentication (get())</a>.</p>
     <li data-md>
@@ -6189,7 +6272,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized③">uvInitialized</a></code> is <code>false</code>,
 update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> in <var>authData</var>.
-This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>;
+This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>;
 if not authorized, skip this step.</p>
      </ol>
      <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> steps,
@@ -6218,7 +6301,7 @@ <h3 class="heading settled" data-level="8.1" id="sctn-attstn-fmt-ids"><span clas
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
    <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span class="secno">8.2. </span><span class="content">Packed Attestation Statement Format</span><a class="self-link" href="#sctn-packed-attestation"></a></h3>
    <p>This is a WebAuthn optimized attestation statement format. It uses a very compact but still extensible encoding method. It is
-implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticators</a> with limited resources (e.g., secure elements).</p>
+implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticators</a> with limited resources (e.g., secure elements).</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6498,11 +6581,11 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
-produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
+produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
 the attestation</a> is consistent with the fields of the attestation certificate’s extension data.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
@@ -6575,7 +6658,7 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
    <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -6668,7 +6751,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
       <dt data-md>sig
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①④">attestation signature</a>.
-The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> from the authenticator.</p>
+The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> from the authenticator.</p>
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
@@ -6723,9 +6806,9 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a> MAY also directly generate attestation statements of this format
-if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> MAY also directly generate attestation statements of this format
+if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a>.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6855,16 +6938,16 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 client. <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension④">Client extensions</a> define the following steps and data:</p>
    <ul>
     <li data-md>
-     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
+     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
     <li data-md>
-     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">navigator.credentials.get()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②">authentication extensions</a>.</p>
+     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">navigator.credentials.get()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②">authentication extensions</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
-   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
-(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
+   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> can request the use of a set
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call
+(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
 processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">Authenticator extensions</a> define the following steps and data:</p>
    <ul>
@@ -6876,24 +6959,24 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
      <p><a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing②">Authenticator extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑥">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑥">authentication extensions</a>.</p>
    </ul>
    <p>For <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑥">authenticator extensions</a>, as part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑧">client extension processing</a>, the client also creates the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①①">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑤">authenticator extension input</a> value for each extension (often based on the corresponding <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑧">client extension input</a> value),
-and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
+and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
 represented in <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①②">CBOR</a> and passed as name-value pairs, with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①①">extension identifier</a> as the name, and the corresponding <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑦">authenticator extension input</a> as the value. The authenticator, in turn, performs additional processing for the extensions
 that it supports, and returns the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①③">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑦">authenticator extension output</a> for each as specified by the extension.
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
 Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> does not endanger the user’s security or privacy.
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①①">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
 that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension inputs</a> from JSON to CBOR
 will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
 being ignored by the authenticator. Since all extensions are OPTIONAL, this will not cause a functional failure in the API
 operation.</p>
    <p>The IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> can be consulted
-for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a>.</p>
+for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①②">WebAuthn Extensions</a>.</p>
    <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class="secno">9.1. </span><span class="content">Extension Identifiers</span><a class="self-link" href="#sctn-extension-id"></a></h3>
    <p>Extensions are identified by a string, called an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="extension-identifier">extension identifier</dfn>, chosen by the extension author.</p>
    <p>Extension identifiers SHOULD be registered in the
@@ -6909,25 +6992,25 @@ <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class=
 See the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list of registered WebAuthn Extension Identifiers.</p>
    <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><span class="secno">9.2. </span><span class="content">Defining Extensions</span><a class="self-link" href="#sctn-extension-specification"></a></h3>
    <p>A definition of an extension MUST specify an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a>, a <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a> argument
-to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call,
+to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> call,
 the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing①⓪">client extension processing</a> rules, and a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①②">client extension output</a> value.
 If the extension communicates with the authenticator (meaning it is an <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑧">authenticator extension</a>),
 it MUST also specify the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①④">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑨">authenticator extension input</a> argument
 sent via the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑦">authenticatorGetAssertion</a> or <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑦">authenticatorMakeCredential</a> call,
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
-   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
+   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
 an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
    <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-parameters"><span class="secno">9.3. </span><span class="content">Extending Request Parameters</span><a class="self-link" href="#sctn-extension-request-parameters"></a></h3>
    <p>An extension defines one or two request arguments. The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-input">client extension input</dfn>,
-which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Party</a> to the client
-in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③③">create()</a></code> call,
+which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a> to the client
+in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③④">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -6967,7 +7050,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
    <p class="note" role="note"><span class="marker">Note:</span> Extensions should aim to define authenticator arguments that are as small as possible. Some authenticators communicate
     over low-bandwidth links such as Bluetooth Low-Energy or NFC.</p>
    <h3 class="heading settled" data-level="9.4" id="sctn-client-extension-processing"><span class="secno">9.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-processing">Client Extension Processing</dfn></span><a class="self-link" href="#sctn-client-extension-processing"></a></h3>
-   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> during the creation of credentials or the
+   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> during the creation of credentials or the
 generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> for the extension is used as an input to this client processing.
 For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a> as the value.</p>
    <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults④">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑧">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
@@ -6995,7 +7078,7 @@ <h2 class="heading settled" data-level="10" id="sctn-defined-extensions"><span c
    <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions"><span class="secno">10.1. </span><span class="content">Client Extensions</span><a class="self-link" href="#sctn-defined-client-extensions"></a></h3>
    <p>This section defines extensions that are only <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑦">client extensions</a>.</p>
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
-   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> that have previously registered a
+   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a>. The
 FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
@@ -7005,10 +7088,10 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> option
- of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> method:</p>
+ of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">get()</a></code> method:</p>
      <ul>
       <li data-md>
-       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
+       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑥">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑥">public-key</a></code>.</p>
       <li data-md>
        <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①①">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①②">id</a></code>.</p>
      </ul>
@@ -7039,7 +7122,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
     <dd data-md>
      <p>A single USVString specifying a FIDO <var>AppID</var>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑥"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appid"><code><c- g>appid</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
@@ -7052,7 +7135,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
        <p>Let <var>appId</var> be the extension input.</p>
       <li data-md>
        <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">determining if a
-caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑨">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code>.</p>
+caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⓪">DOMException</a></code>.</p>
       <li data-md>
        <p>When <a href="#allowCredentialDescriptorListCreation">building allowCredentialDescriptorList</a>,
 if a U2F authenticator indicates that a credential is inapplicable (i.e. by
@@ -7088,8 +7171,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
-   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑧">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7101,7 +7184,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
     <dd data-md>
      <p>A single USVString specifying a FIDO <var>AppID</var>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑦"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①"><c- b>USVString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="USVString" id="dom-authenticationextensionsclientinputs-appidexclude"><code><c- g>appidExclude</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
@@ -7119,7 +7202,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
         <li data-md>
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
-return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①⓪">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑨">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
+return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③①">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
          <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site①">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
@@ -7153,8 +7236,8 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
            <p>If <var>authenticator</var> responds with <code>message:error:test-of-user-presence-required</code> (i.e., success):
 cease normal processing of this <var>authenticator</var> and indicate in a platform-specific manner
 that the authenticator is inapplicable. For example, this could be in the form of UI, or
-could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②②">user consent</a> from <var>authenticator</var> and, upon receipt, treating
-it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑤">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
+could involve requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②③">user consent</a> from <var>authenticator</var> and, upon receipt, treating
+it as if the authenticator had returned <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror⑥">InvalidStateError</a></code>. Requesting <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> can be accomplished by sending another <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> as
 above except for setting <var>control byte</var> to <code>0x03</code> ("enforce-user-presence-and-sign"),
 and ignoring the response.</p>
          </ol>
@@ -7180,7 +7263,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">public key credential source</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7212,7 +7295,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②"><c- g>rk</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname③"><c- g>authenticatorDisplayName</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString②"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname③"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -7228,19 +7311,19 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a></span>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString③">USVString</a></span>
        <dd data-md>
         <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
 chosen by the user.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> MUST allow the user to choose this value.
+        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> MUST allow the user to choose this value.
 That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication</a> ceremony or MAY be made available outside
-the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> MAY reuse the same value
+the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> MAY reuse the same value
 for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Parties</a>.</p>
-        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a>, by some unspecified mechanism, for this
-value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> MAY allow the user to configure the response to such a
-query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> vendor MAY provide a default response to such a query.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> MAY consider a user-configured response chosen by the user,
+        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a>, by some unspecified mechanism, for this
+value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> MAY allow the user to configure the response to such a
+query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a> vendor MAY provide a default response to such a query.
+The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> MAY consider a user-configured response chosen by the user,
 and SHOULD allow the user to modify a vendor-provided default response.</p>
         <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output,
@@ -7261,10 +7344,10 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
    <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
-   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
+   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
-   <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> is identical.</p>
+   <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7281,7 +7364,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></dfn> {
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record①"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record①"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues>" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑨"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7292,8 +7375,8 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-eval"><code>eval</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues②">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
-        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑦">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
+        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
        <dd data-md>
         <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> is not empty.</p>
       </dl>
@@ -7302,7 +7385,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⓪">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
       <li data-md>
        <p>Set <code>hmac-secret</code> to <code>true</code> in the authenticator extensions input.</p>
       <li data-md>
@@ -7322,9 +7405,9 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
       <li data-md>
-       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
+       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
       <li data-md>
        <p>Initialize the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-prf" id="ref-for-dom-authenticationextensionsclientoutputs-prf">prf</a></code> extension output to an empty dictionary.</p>
       <li data-md>
@@ -7343,7 +7426,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
         <li data-md>
          <p>If <code><var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second②">second</a></code></code> is present, let <code>salt2</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second③">second</a></code>)</code>.</p>
         <li data-md>
-         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
+         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
         <li data-md>
          <p>Decrypt the extension result and set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results①">results</a></code> to the PRF result(s), if any.</p>
        </ol>
@@ -7374,14 +7457,14 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
    <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs" id="ref-for-authenticatorLargeBlobs">large, per-credential blobs</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
-and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤">required</a></code>.
-However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>.</p>
+and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑧">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑥">required</a></code>.
+However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7401,14 +7484,14 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑨"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
     <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①④"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⓪">DOMString</a></span>
        <dd data-md>
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
@@ -7426,7 +7509,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read①">read</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write①">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support①">support</a></code> is present and has the value <code class="idl"><a data-link-type="idl" href="#dom-largeblobsupport-required" id="ref-for-dom-largeblobsupport-required">required</a></code>:</p>
@@ -7455,13 +7538,13 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support③">support</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If both <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read②">read</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write②">write</a></code> are present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read③">read</a></code> is present and has the value <code>true</code>:</p>
@@ -7481,10 +7564,10 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
          <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> does not contain exactly one element:</p>
          <ol>
           <li data-md>
-           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
+           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑨">NotSupportedError</a></code>”.</p>
          </ol>
         <li data-md>
-         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticator</a>, associated with the indicated credential.</p>
+         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a>, associated with the indicated credential.</p>
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written">written</a></code> to <code>true</code> if successful and <code>false</code> otherwise.</p>
        </ol>
@@ -7511,7 +7594,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid⑤">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a>, associated with the specified credential.</p>
+        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, associated with the specified credential.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension processing
@@ -7521,14 +7604,14 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
    <h4 class="heading settled" data-level="10.2.1" id="sctn-supplemental-public-keys-extension"><span class="secno">10.2.1. </span><span class="content">Supplemental public keys extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplementalpubkeys">supplementalPubKeys</dfn>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> is incapable of generating a supplemental key pair, or the registration or authentication operation fails for any reason, that key pair is omitted from the output. If no supplemental key pairs remain then this extension is ignored. In this case, there is no <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys④">supplementalPubKeys</a> extension output generated.</p>
-   <p>Supplemental keys are not <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credentials</a> and they do not have their own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential IDs</a>. Instead, any returned keys are a contextual attribute of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is used—along with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑤">supplementalPubKeys</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, a particular set of supplemental keys are returned by the extension, along with signatures demonstrating proof-of-possession of those keys.</p>
+   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> call.</p>
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a> is incapable of generating a supplemental key pair, or the registration or authentication operation fails for any reason, that key pair is omitted from the output. If no supplemental key pairs remain then this extension is ignored. In this case, there is no <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys④">supplementalPubKeys</a> extension output generated.</p>
+   <p>Supplemental keys are not <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credentials</a> and they do not have their own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential IDs</a>. Instead, any returned keys are a contextual attribute of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is used—along with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑤">supplementalPubKeys</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a>, a particular set of supplemental keys are returned by the extension, along with signatures demonstrating proof-of-possession of those keys.</p>
    <p>Supplemental keys never have a scope that is larger than the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑧">user credential</a>. That is, they are never shared between any two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credentials</a> and can never be used to link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⓪">user credentials</a> together. They only communicate continuity of some property of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①①">user credential</a>.</p>
    <h5 class="heading settled" data-level="10.2.1.1" id="sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.1.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a> including further signatures by “SPK1”.</p>
-   <p>The credential may move beyond the scope of that supplemental key (for example, by being exported and imported elsewhere, if <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a>) and, if used in this new domain, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> operation will return a <i>new</i> supplemental key, SPK2, and its signature. Subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> operations may observe either SPK1 or SPK2, depending on the context in which the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a> is being used.</p>
+   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
+   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a> including further signatures by “SPK1”.</p>
+   <p>The credential may move beyond the scope of that supplemental key (for example, by being exported and imported elsewhere, if <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a>) and, if used in this new domain, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> operation will return a <i>new</i> supplemental key, SPK2, and its signature. Subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④④">get()</a></code> operations may observe either SPK1 or SPK2, depending on the context in which the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a> is being used.</p>
    <p>A usage example is thus:</p>
    <blockquote>
     <p>A sign-in request is received by a website that, by regulation, must require certain authentication standards. The sign-in is done with a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a>, but also includes a supplemental key with an attestation that states that the supplemental key is only synced after a user has met or exceeded those standards. Since that supplemental key has been seen before, and was initially verified to meet the site’s authentication standards, additional sign-in challenges are not required.</p>
@@ -7549,9 +7632,9 @@ <h5 class="heading settled" data-level="10.2.1.2" id="sctn-supplemental-public-k
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionssupplementalpubkeysinputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysInputs</c-></code></dfn> {
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑥"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑨"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⓪"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑦"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦①"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑥"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦①"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⑦"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦③"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7560,20 +7643,20 @@ <h5 class="heading settled" data-level="10.2.1.2" id="sctn-supplemental-public-k
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-scopes"><code>scopes</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦②">DOMString</a>></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-scopes"><code>scopes</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④">DOMString</a>></span>
        <dd data-md>
-        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦③">DOMString</a>, defaulting to <code>"indirect"</code></span>
+        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑤">DOMString</a>, defaulting to <code>"indirect"</code></span>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
         <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect②">indirect</a></code>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④">DOMString</a>>, defaulting to <code>[]</code></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥">DOMString</a>>, defaulting to <code>[]</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
         <p>The default value is the empty list, which indicates no preference.</p>
       </dl>
      </div>
@@ -7691,7 +7774,7 @@ <h5 class="heading settled" data-level="10.2.1.2" id="sctn-supplemental-public-k
       <li data-md>
        <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑧">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
       <li data-md>
-       <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
+       <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
       <li data-md>
        <p>Let <var>spks</var> and <var>spkSigs</var> be empty arrays.</p>
       <li data-md>
@@ -7700,20 +7783,20 @@ <h5 class="heading settled" data-level="10.2.1.2" id="sctn-supplemental-public-k
        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <var>scope</var> in <var>scopes</var>:</p>
        <ol>
         <li data-md>
-         <p>If a supplemental key with scope <var>scope</var> does not already exist for this {<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">RP ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">userHandle</a>} tuple on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, create it using the same public key algorithm as that used by the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑤">user credential</a>'s <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pair</a>, otherwise locate the existing supplemental key.</p>
+         <p>If a supplemental key with scope <var>scope</var> does not already exist for this {<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">RP ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">userHandle</a>} tuple on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a>, create it using the same public key algorithm as that used by the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑤">user credential</a>'s <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pair</a>, otherwise locate the existing supplemental key.</p>
         <li data-md>
          <p>Let <var>attFormat</var> be the chosen <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑧">attestation statement format</a>, and <var>attAaguid</var> be a 16-byte value, based on the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation①">attestation</a></code> in the extension input:</p>
          <dl class="switch">
           <dt data-md>none
           <dd data-md>
-           <p><var>attFormat</var> is "none" or "self", at the authenticator’s discretion, and <var>attAaguid</var> is 16 zero bytes. (Note that, since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key">supplemental public key</a> is already exercised during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> calls, the proof-of-possession property provided by "self" attestation is superfluous in that context.)</p>
+           <p><var>attFormat</var> is "none" or "self", at the authenticator’s discretion, and <var>attAaguid</var> is 16 zero bytes. (Note that, since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key">supplemental public key</a> is already exercised during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">navigator.credentials.create()</a></code> calls, the proof-of-possession property provided by "self" attestation is superfluous in that context.)</p>
           <dt data-md>indirect, direct
           <dd data-md>
-           <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑨">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator’s</a> AAGUID. (Since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①">supplemental public key</a>'s scope is different from the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑥">user credential</a>, it will often have a different attestation. For example, the attestation for a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key②">supplemental public key</a> with “device” scope can be tied to hardware roots of trust, although it does not have to be.)</p>
+           <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑨">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator’s</a> AAGUID. (Since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①">supplemental public key</a>'s scope is different from the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑥">user credential</a>, it will often have a different attestation. For example, the attestation for a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key②">supplemental public key</a> with “device” scope can be tied to hardware roots of trust, although it does not have to be.)</p>
           <dt data-md>enterprise
           <dd data-md>
-           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⓪">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator’s</a> AAGUID.</p>
-           <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticators</a>.</p>
+           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⓪">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator’s</a> AAGUID.</p>
+           <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticators</a>.</p>
          </dl>
         <li data-md>
          <p>Let <var>spk</var> be the newly created or existing supplemental public key, in COSE_Key format <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑨">in the same fashion as for the user credential’s credentialPublicKey</a> when the latter is conveyed in <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①③">attested credential data</a>.</p>
@@ -7721,7 +7804,7 @@ <h5 class="heading settled" data-level="10.2.1.2" id="sctn-supplemental-public-k
          <p>Let <var>supplementalPrivateKey</var> be the newly created or existing private key corresponding to <var>spk</var>.</p>
         <li data-md>
          <p>Let <var>randomNonce</var> be a fresh randomly-generated byte string of 32 bytes maximum length, or a zero length byte string if the authenticator chooses to not generate a nonce.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> <var>randomNonce</var>’s purpose is to randomize the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑤">attestation signature</a> value for <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key③">supplemental public keys</a>. If this is not done, then an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑥">attestation signature</a> value remains constant for all such signatures issued on behalf of this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑦">user credential</a>, possibly exposing the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a>'s <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">attestation private key</a> to side-channel attacks. The randomness-generation mechanism should be carefully chosen by the authenticator implementer.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> <var>randomNonce</var>’s purpose is to randomize the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑤">attestation signature</a> value for <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key③">supplemental public keys</a>. If this is not done, then an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑥">attestation signature</a> value remains constant for all such signatures issued on behalf of this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑦">user credential</a>, possibly exposing the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">attestation private key</a> to side-channel attacks. The randomness-generation mechanism should be carefully chosen by the authenticator implementer.</p>
         <li data-md>
          <p>Let <var>supplementalPubKey</var> be a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②①">CBOR</a> map as defined by <code>attObjForSupplementalPubKey</code> above, with keys and values as follows:</p>
          <p class="note" role="note"><span class="marker">Note:</span> as with all CBOR structures used in this specification, the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form⑤">CTAP2 canonical CBOR encoding form</a> MUST be used.</p>
@@ -7797,7 +7880,7 @@ <h5 class="heading settled" data-level="10.2.1.3" id="sctn-supplemental-public-k
      </dl>
    </dl>
    <h6 class="heading settled" data-level="10.2.1.3.1" id="sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.1.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">navigator.credentials.create()</a></code> call,
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">navigator.credentials.create()</a></code> call,
 then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 20</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
@@ -7842,7 +7925,7 @@ <h6 class="heading settled" data-level="10.2.1.3.1" id="sctn-supplemental-public
    </ol>
    <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.1.1 Relying Party Usage</a> for further details.</p>
    <h6 class="heading settled" data-level="10.2.1.3.2" id="sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.1.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④④">navigator.credentials.get()</a></code> call,
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
 then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
@@ -8063,13 +8146,13 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p>If set to <code>true</code> the authenticator will support <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑥">client-side discoverable credentials</a>.</p>
     <dt data-md><var>hasUserVerification</var>
     <dd data-md>
-     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a>.</p>
+     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">user verification</a>.</p>
     <dt data-md><var>isUserConsenting</var>
     <dd data-md>
-     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
+     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
     <dt data-md><var>isUserVerified</var>
     <dd data-md>
-     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
+     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This property has no effect if <var>hasUserVerification</var> is set to <code>false</code>.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
@@ -8371,7 +8454,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <dl>
       <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type④">type</a>
       <dd data-md>
-       <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑥">public-key</a></code></p>
+       <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑦">public-key</a></code></p>
       <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑦">id</a>
       <dd data-md>
        <p><var>credentialId</var></p>
@@ -8400,7 +8483,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
    <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑨">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②③">Virtual Authenticator</a>, regardless of whether they were
-stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">navigator.credentials.create()</a></code>. It is defined as follows:</p>
+stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
      <thead>
@@ -8621,7 +8704,7 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: none</p>
     <li data-md>
-     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
+     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> of this specification</p>
    </ul>
@@ -8631,7 +8714,7 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
@@ -8642,14 +8725,14 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: appidExclude</p>
     <li data-md>
-     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.1.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
      <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②③">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
@@ -8662,43 +8745,43 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
-The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a>'s
+The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a>'s
 computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑧">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> as to their provenance.</p>
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑧">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
-Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> security characteristics.</p>
+Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> accompanying an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertion</a> is not signed.
-This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a>), and thus the interaction would end in an error.</p>
+This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> returns
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
 For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
-must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>.
-This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> that can be invoked remotely —
-even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
+must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a>.
+This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> that can be invoked remotely —
+even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> has to trust the third party to
-enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>.
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> has to trust the third party to
+enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a>.
 Failure to do either could result in
 a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
-and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
-   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
+and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
+   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span class="secno">13.3.1. </span><span class="content">Attestation Certificate Hierarchy</span><a class="self-link" href="#sctn-cert-hierarchy"></a></h4>
    <p>A 3-tier hierarchy for attestation certificates is RECOMMENDED (i.e., Attestation Root, Attestation Issuing CA, Attestation
 Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
@@ -8707,8 +8790,8 @@ <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span c
 SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥⓪">authenticator data</a>.</p>
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer that
-has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
-intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Parties</a> MUST update their trusted root certificates
+has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
+intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
@@ -8718,20 +8801,20 @@ <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span cl
    <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
    <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
-   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Parties</a> by this specification include:</p>
+   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> can optionally
-enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticators</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> can optionally
+enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticators</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
 Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a> - for example PIN, biometrics and/or future
-methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
+methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a>.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
@@ -8755,15 +8838,15 @@ <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenge
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
    <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> qualities.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statement</a>, on its own,
 provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> was generated
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
 For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> script.
 The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⓪">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> maintains
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
@@ -8771,9 +8854,9 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
    <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
 than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> reports
-a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> model than the user expects.</p>
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> reports
+a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
@@ -8783,16 +8866,16 @@ <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-cer
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
 that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
-different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑧">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code></code> options to ensure that these
+different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
    <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
@@ -8837,7 +8920,7 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of WebAuthn credentials prevents their use on domains
 outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a> they were registered for,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a>'s origin validation serves as an additional layer of protection
-in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
+in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
    <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>.
 For example:</p>
@@ -8880,7 +8963,7 @@ <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><sp
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -8891,73 +8974,73 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
    <ul>
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a>.</p>
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>.</p>
     <li data-md>
      <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a> depending on the implementation.</p>
     <li data-md>
-     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>.</p>
+     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticators</a>, e.g., product names.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>.</p>
     <li data-md>
-     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>.</p>
+     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticators</a>, e.g., serial numbers.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>.</p>
    </ul>
    <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>. The following sections describe the measures taken to
 prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to enable strong
+   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑥">WebAuthn Relying Party</a> to enable strong
 authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑦">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①①⑧">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">user
 consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
 not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
 handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
 This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
 further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑨">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> therefore cannot discover the
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①②①">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> therefore cannot discover the
 user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> cannot expose biometric data for an attacker to
 use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> response,
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> response,
 instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a>.</p>
-   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
+   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
 or link various online identities of the same user together.
 This can be mitigated in several ways, including:</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑨">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticators</a> in batches
-where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑨">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a> in batches
+where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
 This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">private key</a> is compromised.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
 while also minimizing the batch size in order to limit the number of affected users
 in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> is compromised.</p>
-     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
+     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
 sufficiently large groups. This may serve as guidance about suitable batch sizes.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②⓪">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticator</a> can ship with a
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②⓪">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticator</a> can ship with a
 main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑨">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificate</a>),
 and combined with a cloud-operated <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑦">Anonymization CA</a>,
 can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">attestation certificates</a>.</p>
@@ -8967,41 +9050,41 @@ <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><s
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①②⓪">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②①">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication
-ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> has been
-performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> SHOULD NOT store personally identifying information.</p>
-   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
-   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①②②">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①②②">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①②③">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication
+ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> has been
+performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a> SHOULD NOT store personally identifying information.</p>
+   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①①">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
+   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a>'s enrolled user(s).</p>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①②④">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a>:</p>
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑧">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a>:</p>
    <ul>
     <li data-md>
-     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticators</a> are present.</p>
+     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticators</a> are present.</p>
     <li data-md>
-     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> is excluded.</p>
+     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> is excluded.</p>
    </ul>
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
-timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
-   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a></code> parameter is available to the user.</p>
+   <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑨">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to use it.</p>
    </ul>
    <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a>. In this
+failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③②">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a>. In this
 case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> parameter is
 available to the user.</p>
@@ -9010,18 +9093,18 @@ <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><sp
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
    <h4 class="heading settled" data-level="14.5.4" id="sctn-disclosing-client-capabilities"><span class="secno">14.5.4. </span><span class="content">Disclosing Client Capabilities</span><a class="self-link" href="#sctn-disclosing-client-capabilities"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑥">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientcapabilities" id="ref-for-dom-publickeycredential-getclientcapabilities④">getClientCapabilities</a></code> method assists <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Parties</a> in crafting registration and authentication experiences which have a high chance of success with the client and/or user.</p>
    <p>The client’s support or lack of support of a WebAuthn capability may pose a fingerprinting risk. Client implementations MAY wish to limit capability disclosures based on client policy and/or user consent.</p>
    <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
-and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">user verification</a>,
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">user verification</a>,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
 function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑦">WebAuthn Relying Party</a> might leak sensitive
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥①">WebAuthn Relying Party</a> might leak sensitive
 information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
 initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a> responds with a failure, but then
 successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
@@ -9061,7 +9144,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
      <ul>
       <li data-md>
        <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> matching the provided username, continue the
-ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
+ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑥">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
        <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
@@ -9070,7 +9153,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
        <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
@@ -9085,12 +9168,12 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument risks leaking personally identifying information,
 since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticators</a>.</p>
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a>.</p>
    <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑤">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
@@ -9105,7 +9188,7 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> needs to be exposed given only a username,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑥">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥④">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑦">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
    <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑨">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑧">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
@@ -10130,6 +10213,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
    <li>
     <a data-link-type="biblio">[WebIDL]</a> defines the following terms:
     <ul>
+     <li><span class="dfn-paneled" id="d25dfb2c">AbortError</span>
      <li><span class="dfn-paneled" id="2f8afbfe">ArrayBuffer</span>
      <li><span class="dfn-paneled" id="3aff2fb3">BufferSource</span>
      <li><span class="dfn-paneled" id="48c6127a">ConstraintError</span>
@@ -10151,13 +10235,14 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="5372cca8">boolean</span>
      <li><span class="dfn-paneled" id="b05bf85d">buffer source types</span>
      <li><span class="dfn-paneled" id="5bb8971d">enumeration value</span>
-     <li><span class="dfn-paneled" id="7d1b8bad">get a copy of the bytes held by the buffer source</span>
+     <li><span class="dfn-paneled" id="7b05fe24">get a copy of the bytes held by the buffer source</span>
      <li><span class="dfn-paneled" id="4197ac46">interface object</span>
      <li><span class="dfn-paneled" id="7b052415">json type</span>
      <li><span class="dfn-paneled" id="f8de33a3">long</span>
      <li><span class="dfn-paneled" id="efd1ec5d">object</span>
      <li><span class="dfn-paneled" id="7787d359">record</span>
      <li><span class="dfn-paneled" id="9cce47fd">sequence</span>
+     <li><span class="dfn-paneled" id="aa747739">simple exception</span>
      <li><span class="dfn-paneled" id="e97a9688">unsigned long</span>
     </ul>
    <li>
@@ -10522,7 +10607,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource"><c- n>BufferSource</c-></a>                <a class="idl-code" data-link-type="dict-member" data-type="BufferSource" href="#dom-publickeycredentialrequestoptions-challenge"><c- g>challenge</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long" href="#dom-publickeycredentialrequestoptions-timeout"><c- g>timeout</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="USVString" href="#dom-publickeycredentialrequestoptions-rpid"><c- g>rpId</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-rpid"><c- g>rpId</c-></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>" href="#dom-publickeycredentialrequestoptions-allowcredentials"><c- g>allowCredentials</c-></a> = [];
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString" href="#dom-publickeycredentialrequestoptions-userverification"><c- g>userVerification</c-></a> = "preferred";
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>>                  <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString>" href="#dom-publickeycredentialrequestoptions-hints"><c- g>hints</c-></a> = [];
@@ -11179,11 +11264,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "287c5e31": {"dfnID":"287c5e31","dfnText":"subjectpublickeyinfo","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4.1.2.7"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-section-4.1.2.7\u2460"},{"id":"ref-for-section-4.1.2.7\u2461"},{"id":"ref-for-section-4.1.2.7\u2462"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc5280#section-4.1.2.7"},
 "28e64574": {"dfnID":"28e64574","dfnText":"abort reason","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal-abort-reason"},{"id":"ref-for-abortsignal-abort-reason\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortsignal-abort-reason\u2461"},{"id":"ref-for-abortsignal-abort-reason\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://dom.spec.whatwg.org/#abortsignal-abort-reason"},
 "2a800450": {"dfnID":"2a800450","dfnText":"section 4","external":true,"refSections":[{"refs":[{"id":"ref-for-section-4"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-4"},
-"2e66eaf1": {"dfnID":"2e66eaf1","dfnText":"AbortController","external":true,"refSections":[{"refs":[{"id":"ref-for-abortcontroller"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2461"},{"id":"ref-for-abortcontroller\u2462"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortcontroller"},
+"2e66eaf1": {"dfnID":"2e66eaf1","dfnText":"AbortController","external":true,"refSections":[{"refs":[{"id":"ref-for-abortcontroller"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-abortcontroller\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-abortcontroller\u2462"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-abortcontroller\u2463"},{"id":"ref-for-abortcontroller\u2464"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortcontroller"},
 "2ec1d49c": {"dfnID":"2ec1d49c","dfnText":"authentication factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
 "2f8afbfe": {"dfnID":"2f8afbfe","dfnText":"ArrayBuffer","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-ArrayBuffer"},{"id":"ref-for-idl-ArrayBuffer\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2468"},{"id":"ref-for-idl-ArrayBuffer\u2460\u24ea"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2464"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2460\u2465"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2467"},{"id":"ref-for-idl-ArrayBuffer\u2460\u2468"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u24ea"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2460"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2461"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2462"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2463"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2464"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2465"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2466"},{"id":"ref-for-idl-ArrayBuffer\u2461\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-ArrayBuffer\u2461\u2468"},{"id":"ref-for-idl-ArrayBuffer\u2462\u24ea"}],"title":"10.2.1.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},
 "31236ec1": {"dfnID":"31236ec1","dfnText":"section 4.3","external":true,"refSections":[{"refs":[{"id":"ref-for-registration-response-message-success"},{"id":"ref-for-registration-response-message-success\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success"},
-"3182eb71": {"dfnID":"3182eb71","dfnText":"NotSupportedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notsupportederror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2460"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notsupportederror\u2462"},{"id":"ref-for-notsupportederror\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-notsupportederror\u2464"},{"id":"ref-for-notsupportederror\u2465"},{"id":"ref-for-notsupportederror\u2466"},{"id":"ref-for-notsupportederror\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#notsupportederror"},
+"3182eb71": {"dfnID":"3182eb71","dfnText":"NotSupportedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notsupportederror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-notsupportederror\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notsupportederror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notsupportederror\u2463"},{"id":"ref-for-notsupportederror\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-notsupportederror\u2465"},{"id":"ref-for-notsupportederror\u2466"},{"id":"ref-for-notsupportederror\u2467"},{"id":"ref-for-notsupportederror\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#notsupportederror"},
 "31db57e6": {"dfnID":"31db57e6","dfnText":"keys","external":true,"refSections":[{"refs":[{"id":"ref-for-map-getting-the-keys"},{"id":"ref-for-map-getting-the-keys\u2460"},{"id":"ref-for-map-getting-the-keys\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"}],"url":"https://infra.spec.whatwg.org/#map-getting-the-keys"},
 "31e1c2ad": {"dfnID":"31e1c2ad","dfnText":"store()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-store"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store"},
 "32f756ae": {"dfnID":"32f756ae","dfnText":"preventSilentAccess()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-preventsilentaccess"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess"},
@@ -11198,7 +11283,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "43ac8374": {"dfnID":"43ac8374","dfnText":"origin (for environment settings object)","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-origin"},{"id":"ref-for-concept-settings-object-origin\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2461"},{"id":"ref-for-concept-settings-object-origin\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2463"},{"id":"ref-for-concept-settings-object-origin\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-settings-object-origin\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin"},
 "45209803": {"dfnID":"45209803","dfnText":"for each (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-iterate"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-iterate\u2461"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-map-iterate\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-iterate\u2463"},{"id":"ref-for-map-iterate\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-map-iterate\u2465"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-map-iterate\u2466"}],"title":"10.2.1.2. Extension Definition"}],"url":"https://infra.spec.whatwg.org/#map-iterate"},
 "47fe679e": {"dfnID":"47fe679e","dfnText":"transient activation","external":true,"refSections":[{"refs":[{"id":"ref-for-transient-activation"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/interaction.html#transient-activation"},
-"48c6127a": {"dfnID":"48c6127a","dfnText":"ConstraintError","external":true,"refSections":[{"refs":[{"id":"ref-for-constrainterror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-constrainterror\u2460"},{"id":"ref-for-constrainterror\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://webidl.spec.whatwg.org/#constrainterror"},
+"48c6127a": {"dfnID":"48c6127a","dfnText":"ConstraintError","external":true,"refSections":[{"refs":[{"id":"ref-for-constrainterror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-constrainterror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-constrainterror\u2461"},{"id":"ref-for-constrainterror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"https://webidl.spec.whatwg.org/#constrainterror"},
 "4a044e45": {"dfnID":"4a044e45","dfnText":"is not a registrable domain suffix of and is not equal to","external":true,"refSections":[{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"},{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}],"title":"5.11. Using Web Authentication across related origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to"},
 "4be6272b": {"dfnID":"4be6272b","dfnText":"success","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-success"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2460"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-success\u2461"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-success\u2462"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2463"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-success\u2464"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-success\u2465"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-success\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-success"},
 "53275e46": {"dfnID":"53275e46","dfnText":"append (for list)","external":true,"refSections":[{"refs":[{"id":"ref-for-list-append"},{"id":"ref-for-list-append\u2460"},{"id":"ref-for-list-append\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-append\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#list-append"},
@@ -11228,37 +11313,37 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "7482107b": {"dfnID":"7482107b","dfnText":"webdriver error code","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-error-code"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-error-code\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-error-code\u2461"},{"id":"ref-for-dfn-error-code\u2462"},{"id":"ref-for-dfn-error-code\u2463"},{"id":"ref-for-dfn-error-code\u2464"},{"id":"ref-for-dfn-error-code\u2465"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2466"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-error-code\u2467"},{"id":"ref-for-dfn-error-code\u2468"},{"id":"ref-for-dfn-error-code\u2460\u24ea"},{"id":"ref-for-dfn-error-code\u2460\u2460"},{"id":"ref-for-dfn-error-code\u2460\u2461"},{"id":"ref-for-dfn-error-code\u2460\u2462"},{"id":"ref-for-dfn-error-code\u2460\u2463"},{"id":"ref-for-dfn-error-code\u2460\u2464"},{"id":"ref-for-dfn-error-code\u2460\u2465"},{"id":"ref-for-dfn-error-code\u2460\u2466"},{"id":"ref-for-dfn-error-code\u2460\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2460\u2468"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u24ea"},{"id":"ref-for-dfn-error-code\u2461\u2460"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2461"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2462"},{"id":"ref-for-dfn-error-code\u2461\u2463"},{"id":"ref-for-dfn-error-code\u2461\u2464"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-error-code\u2461\u2465"},{"id":"ref-for-dfn-error-code\u2461\u2466"},{"id":"ref-for-dfn-error-code\u2461\u2467"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-error-code"},
 "7787d359": {"dfnID":"7787d359","dfnText":"record","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-record"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-record\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-record"},
 "77a2ee6e": {"dfnID":"77a2ee6e","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-host"},{"id":"ref-for-concept-origin-host\u2460"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-host"},
-"797018a7": {"dfnID":"797018a7","dfnText":"InvalidStateError","external":true,"refSections":[{"refs":[{"id":"ref-for-invalidstateerror"},{"id":"ref-for-invalidstateerror\u2460"},{"id":"ref-for-invalidstateerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-invalidstateerror\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-invalidstateerror\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-invalidstateerror\u2464"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
-"79cad4dd": {"dfnID":"79cad4dd","dfnText":"valid domain","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-valid-domain\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#valid-domain"},
+"797018a7": {"dfnID":"797018a7","dfnText":"InvalidStateError","external":true,"refSections":[{"refs":[{"id":"ref-for-invalidstateerror"},{"id":"ref-for-invalidstateerror\u2460"},{"id":"ref-for-invalidstateerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-invalidstateerror\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-invalidstateerror\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-invalidstateerror\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-invalidstateerror\u2465"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#invalidstateerror"},
+"79cad4dd": {"dfnID":"79cad4dd","dfnText":"valid domain","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-valid-domain\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-valid-domain\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-valid-domain\u2463"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://url.spec.whatwg.org/#valid-domain"},
 "79ff34a5": {"dfnID":"79ff34a5","dfnText":"Credential","external":true,"refSections":[{"refs":[{"id":"ref-for-credential"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-credential\u2460"},{"id":"ref-for-credential\u2461"},{"id":"ref-for-credential\u2462"},{"id":"ref-for-credential\u2463"},{"id":"ref-for-credential\u2464"},{"id":"ref-for-credential\u2465"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#credential"},
 "7ad9ecbb": {"dfnID":"7ad9ecbb","dfnText":"something you have","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
 "7b052415": {"dfnID":"7b052415","dfnText":"json type","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-json-types"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dfn-json-types\u2460"},{"id":"ref-for-dfn-json-types\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-json-types\u2462"},{"id":"ref-for-dfn-json-types\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
+"7b05fe24": {"dfnID":"7b05fe24","dfnText":"get a copy of the bytes held by the buffer source","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy"},
 "7b91cdaa": {"dfnID":"7b91cdaa","dfnText":"section 5.4","external":true,"refSections":[{"refs":[{"id":"ref-for-authentication-response-message-success"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"}],"url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},
 "7c356e70": {"dfnID":"7c356e70","dfnText":"second-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
-"7d1b8bad": {"dfnID":"7d1b8bad","dfnText":"get a copy of the bytes held by the buffer source","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dfn-get-buffer-source-copy\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://heycam.github.io/webidl#dfn-get-buffer-source-copy"},
 "7d924173": {"dfnID":"7d924173","dfnText":"large, per-credential blobs","external":true,"refSections":[{"refs":[{"id":"ref-for-authenticatorLargeBlobs"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticatorLargeBlobs\u2460"},{"id":"ref-for-authenticatorLargeBlobs\u2461"}],"title":"11.5. Add Credential"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs"},
 "7eefe7a7": {"dfnID":"7eefe7a7","dfnText":"determining the facetid of a calling application","external":true,"refSections":[{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2460"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-determining-the-facetid-of-a-calling-application\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application"},
 "802b0fdd": {"dfnID":"802b0fdd","dfnText":"value","external":true,"refSections":[{"refs":[{"id":"ref-for-map-value"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-value"},
 "81daedb9": {"dfnID":"81daedb9","dfnText":"focus","external":true,"refSections":[{"refs":[{"id":"ref-for-focus"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://html.spec.whatwg.org/#focus"},
 "81dd847b": {"dfnID":"81dd847b","dfnText":"UnknownError","external":true,"refSections":[{"refs":[{"id":"ref-for-unknownerror"},{"id":"ref-for-unknownerror\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-unknownerror\u2461"},{"id":"ref-for-unknownerror\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#unknownerror"},
 "82c23298": {"dfnID":"82c23298","dfnText":"remote end steps","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-remote-end-steps"},{"id":"ref-for-dfn-remote-end-steps\u2460"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2461"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2462"},{"id":"ref-for-dfn-remote-end-steps\u2463"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2464"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2465"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2466"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2467"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-remote-end-steps\u2468"},{"id":"ref-for-dfn-remote-end-steps\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-remote-end-steps"},
-"82ca3efc": {"dfnID":"82ca3efc","dfnText":"TypeError","external":true,"refSections":[{"refs":[{"id":"ref-for-exceptiondef-typeerror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
+"82ca3efc": {"dfnID":"82ca3efc","dfnText":"TypeError","external":true,"refSections":[{"refs":[{"id":"ref-for-exceptiondef-typeerror"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-exceptiondef-typeerror\u2461"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
 "85394472": {"dfnID":"85394472","dfnText":"Document","external":true,"refSections":[{"refs":[{"id":"ref-for-document"}],"title":"5.9. Permissions Policy integration"}],"url":"https://dom.spec.whatwg.org/#document"},
 "87478abb": {"dfnID":"87478abb","dfnText":"document.domain","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-document-domain"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
 "87d65d53": {"dfnID":"87d65d53","dfnText":"section 7","external":true,"refSections":[{"refs":[{"id":"ref-for-section-7"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-section-7\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-section-7\u2461"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-section-7\u2462"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://tools.ietf.org/html/rfc9052#section-7"},
 "87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"},{"id":"ref-for-the-iframe-element\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"},{"id":"ref-for-the-iframe-element\u2466"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
 "8841d736": {"dfnID":"8841d736","dfnText":"internal method","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461\u24ea"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
-"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"},{"id":"ref-for-idl-DOMString\u2460\u2463"},{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"},{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"},{"id":"ref-for-idl-DOMString\u2462\u2461"},{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"},{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"},{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"},{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"},{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"},{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"},{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"}],"title":"10.2.1.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
+"8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"},{"id":"ref-for-idl-DOMString\u2460\u2463"},{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"},{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"},{"id":"ref-for-idl-DOMString\u2462\u2461"},{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"},{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"},{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"},{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"},{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"},{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"},{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"},{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"},{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"},{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"},{"id":"ref-for-idl-DOMString\u2466\u2464"},{"id":"ref-for-idl-DOMString\u2466\u2465"}],"title":"10.2.1.2. Extension Definition"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
 "889e932f": {"dfnID":"889e932f","dfnText":"Exposed","external":true,"refSections":[{"refs":[{"id":"ref-for-Exposed"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-Exposed\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-Exposed\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-Exposed\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#Exposed"},
 "8958b003": {"dfnID":"8958b003","dfnText":"entry","external":true,"refSections":[{"refs":[{"id":"ref-for-map-entry"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-map-entry\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-entry"},
 "8a30477b": {"dfnID":"8a30477b","dfnText":"global object","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-settings-object-global"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-settings-object-global\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global"},
-"8c1e3a13": {"dfnID":"8c1e3a13","dfnText":"effective domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-effective-domain"},{"id":"ref-for-concept-origin-effective-domain\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2464"},{"id":"ref-for-concept-origin-effective-domain\u2465"},{"id":"ref-for-concept-origin-effective-domain\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2467"},{"id":"ref-for-concept-origin-effective-domain\u2468"},{"id":"ref-for-concept-origin-effective-domain\u2460\u24ea"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2465"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
+"8c1e3a13": {"dfnID":"8c1e3a13","dfnText":"effective domain","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-effective-domain"},{"id":"ref-for-concept-origin-effective-domain\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2464"},{"id":"ref-for-concept-origin-effective-domain\u2465"},{"id":"ref-for-concept-origin-effective-domain\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2467"},{"id":"ref-for-concept-origin-effective-domain\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u24ea"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2460"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2461"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2463"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2464"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2466"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2460\u2467"},{"id":"ref-for-concept-origin-effective-domain\u2460\u2468"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-origin-effective-domain\u2461\u24ea"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain"},
 "8da4d1e3": {"dfnID":"8da4d1e3","dfnText":"invalid argument","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-invalid-argument"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461"},{"id":"ref-for-dfn-invalid-argument\u2462"},{"id":"ref-for-dfn-invalid-argument\u2463"},{"id":"ref-for-dfn-invalid-argument\u2464"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2465"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2466"},{"id":"ref-for-dfn-invalid-argument\u2467"},{"id":"ref-for-dfn-invalid-argument\u2468"},{"id":"ref-for-dfn-invalid-argument\u2460\u24ea"},{"id":"ref-for-dfn-invalid-argument\u2460\u2460"},{"id":"ref-for-dfn-invalid-argument\u2460\u2461"},{"id":"ref-for-dfn-invalid-argument\u2460\u2462"},{"id":"ref-for-dfn-invalid-argument\u2460\u2463"},{"id":"ref-for-dfn-invalid-argument\u2460\u2464"},{"id":"ref-for-dfn-invalid-argument\u2460\u2465"},{"id":"ref-for-dfn-invalid-argument\u2460\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2467"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2468"},{"id":"ref-for-dfn-invalid-argument\u2461\u24ea"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2460"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2461"},{"id":"ref-for-dfn-invalid-argument\u2461\u2462"},{"id":"ref-for-dfn-invalid-argument\u2461\u2463"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2464"},{"id":"ref-for-dfn-invalid-argument\u2461\u2465"},{"id":"ref-for-dfn-invalid-argument\u2461\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-invalid-argument"},
 "8de17130": {"dfnID":"8de17130","dfnText":"valid domain string","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain-string"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain-string\u2460"},{"id":"ref-for-valid-domain-string\u2461"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#valid-domain-string"},
 "91748ad6": {"dfnID":"91748ad6","dfnText":"default allowlists","external":true,"refSections":[{"refs":[{"id":"ref-for-policy-controlled-feature-default-allowlist"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist"},
 "944c2033": {"dfnID":"944c2033","dfnText":"credential source","external":true,"refSections":[{"refs":[{"id":"ref-for-credential-source"}],"title":"4. Terminology"}],"url":"https://w3c.github.io/webappsec-credential-management/#credential-source"},
 "984221ca": {"dfnID":"984221ca","dfnText":"struct","external":true,"refSections":[{"refs":[{"id":"ref-for-struct"},{"id":"ref-for-struct\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct\u2463"},{"id":"ref-for-struct\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct\u2465"}],"title":"10.2.1.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"https://infra.spec.whatwg.org/#struct"},
-"99134679": {"dfnID":"99134679","dfnText":"get()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-get"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2463"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2466"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2467"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2468"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2466"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2468"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2462"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2463"}],"title":"10.2.1.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2464"}],"title":"14.6.2. Username Enumeration"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
+"99134679": {"dfnID":"99134679","dfnText":"get()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-get"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2462"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2463"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2466"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-get\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2464"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2461\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2461\u2468"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2463"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2465"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2466"},{"id":"ref-for-dom-credentialscontainer-get\u2462\u2467"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2462\u2468"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u24ea"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2460"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2461"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2462"},{"id":"ref-for-dom-credentialscontainer-get\u2463\u2463"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2464"}],"title":"10.2.1.3.2. Authentication (get())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-get\u2463\u2465"}],"title":"14.6.2. Username Enumeration"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get"},
 "99c988d6": {"dfnID":"99c988d6","dfnText":"remove","external":true,"refSections":[{"refs":[{"id":"ref-for-list-remove"},{"id":"ref-for-list-remove\u2460"},{"id":"ref-for-list-remove\u2461"},{"id":"ref-for-list-remove\u2462"},{"id":"ref-for-list-remove\u2463"},{"id":"ref-for-list-remove\u2464"},{"id":"ref-for-list-remove\u2465"},{"id":"ref-for-list-remove\u2466"},{"id":"ref-for-list-remove\u2467"},{"id":"ref-for-list-remove\u2468"},{"id":"ref-for-list-remove\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2460\u2460"},{"id":"ref-for-list-remove\u2460\u2461"},{"id":"ref-for-list-remove\u2460\u2462"},{"id":"ref-for-list-remove\u2460\u2463"},{"id":"ref-for-list-remove\u2460\u2464"},{"id":"ref-for-list-remove\u2460\u2465"},{"id":"ref-for-list-remove\u2460\u2466"},{"id":"ref-for-list-remove\u2460\u2467"},{"id":"ref-for-list-remove\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-remove\u2461\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://infra.spec.whatwg.org/#list-remove"},
 "9befea0b": {"dfnID":"9befea0b","dfnText":"EncodingError","external":true,"refSections":[{"refs":[{"id":"ref-for-encodingerror"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-encodingerror\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#encodingerror"},
 "9c4c1e66": {"dfnID":"9c4c1e66","dfnText":"relevant settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-relevant-settings-object"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relevant-settings-object\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relevant-settings-object\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object"},
@@ -11281,6 +11366,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "a944ac4c": {"dfnID":"a944ac4c","dfnText":"origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-concept-origin\u2460"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-concept-origin\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-concept-origin\u2462"},{"id":"ref-for-concept-origin\u2463"},{"id":"ref-for-concept-origin\u2464"},{"id":"ref-for-concept-origin\u2465"},{"id":"ref-for-concept-origin\u2466"},{"id":"ref-for-concept-origin\u2467"},{"id":"ref-for-concept-origin\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-concept-origin\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2462"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2463"},{"id":"ref-for-concept-origin\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2465"},{"id":"ref-for-concept-origin\u2460\u2466"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-concept-origin\u2460\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin"},
 "a973e0fe": {"dfnID":"a973e0fe","dfnText":"document","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-document"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-document\u2460"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#concept-document"},
 "aa6633ff": {"dfnID":"aa6633ff","dfnText":"multi-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-af"},{"id":"ref-for-af\u2460"},{"id":"ref-for-af\u2461"},{"id":"ref-for-af\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-af\u2463"},{"id":"ref-for-af\u2464"},{"id":"ref-for-af\u2465"},{"id":"ref-for-af\u2466"},{"id":"ref-for-af\u2467"},{"id":"ref-for-af\u2468"},{"id":"ref-for-af\u2460\u24ea"},{"id":"ref-for-af\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-af\u2460\u2461"},{"id":"ref-for-af\u2460\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-af\u2460\u2463"},{"id":"ref-for-af\u2460\u2464"},{"id":"ref-for-af\u2460\u2465"},{"id":"ref-for-af\u2460\u2466"},{"id":"ref-for-af\u2460\u2467"},{"id":"ref-for-af\u2460\u2468"},{"id":"ref-for-af\u2461\u24ea"},{"id":"ref-for-af\u2461\u2460"},{"id":"ref-for-af\u2461\u2461"},{"id":"ref-for-af\u2461\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-af\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-af\u2461\u2464"},{"id":"ref-for-af\u2461\u2465"},{"id":"ref-for-af\u2461\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#af"},
+"aa747739": {"dfnID":"aa747739","dfnText":"simple exception","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-simple-exception"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dfn-simple-exception\u2460"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://webidl.spec.whatwg.org/#dfn-simple-exception"},
 "aaf09faf": {"dfnID":"aaf09faf","dfnText":"salted","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
 "aaguid": {"dfnID":"aaguid","dfnText":"AAGUID","external":false,"refSections":[{"refs":[{"id":"ref-for-aaguid"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-aaguid\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-aaguid\u2461"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-aaguid\u2462"},{"id":"ref-for-aaguid\u2463"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-aaguid\u2464"}],"title":"10.2.1.2.1. AAGUIDs"},{"refs":[{"id":"ref-for-aaguid\u2465"}],"title":"10.2.1.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"#aaguid"},
 "ab309409": {"dfnID":"ab309409","dfnText":"serialize json to bytes","external":true,"refSections":[{"refs":[{"id":"ref-for-serialize-a-javascript-value-to-json-bytes"},{"id":"ref-for-serialize-a-javascript-value-to-json-bytes\u2460"}],"title":"5.8.1.1. Serialization"}],"url":"https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes"},
@@ -11297,7 +11383,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "abstract-opdef-credential-record-transports": {"dfnID":"abstract-opdef-credential-record-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-transports\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-transports"},
 "abstract-opdef-credential-record-type": {"dfnID":"abstract-opdef-credential-record-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2460"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-type\u2461"}],"title":"7.1. Registering a New Credential"}],"url":"#abstract-opdef-credential-record-type"},
 "abstract-opdef-credential-record-uvinitialized": {"dfnID":"abstract-opdef-credential-record-uvinitialized","dfnText":"uvInitialized","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized"},{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-abstract-opdef-credential-record-uvinitialized\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#abstract-opdef-credential-record-uvinitialized"},
-"abstract-opdef-related-origins-validation-procedure": {"dfnID":"abstract-opdef-related-origins-validation-procedure","dfnText":"related origins validation procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"#abstract-opdef-related-origins-validation-procedure"},
+"abstract-opdef-related-origins-validation-procedure": {"dfnID":"abstract-opdef-related-origins-validation-procedure","dfnText":"related origins validation procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-abstract-opdef-related-origins-validation-procedure\u2462"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"#abstract-opdef-related-origins-validation-procedure"},
 "abstract-opdef-supplementalpubkeys-record-aaguid": {"dfnID":"abstract-opdef-supplementalpubkeys-record-aaguid","dfnText":"aaguid","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2461"}],"title":"10.2.1.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-aaguid"},
 "abstract-opdef-supplementalpubkeys-record-attstmt": {"dfnID":"abstract-opdef-supplementalpubkeys-record-attstmt","dfnText":"attStmt","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2460"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2461"},{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2462"}],"title":"10.2.1.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-attstmt"},
 "abstract-opdef-supplementalpubkeys-record-fmt": {"dfnID":"abstract-opdef-supplementalpubkeys-record-fmt","dfnText":"fmt","external":false,"refSections":[{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-fmt"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-abstract-opdef-supplementalpubkeys-record-fmt\u2460"}],"title":"10.2.1.3.2. Authentication (get())"}],"url":"#abstract-opdef-supplementalpubkeys-record-fmt"},
@@ -11356,7 +11442,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authentication-ceremony": {"dfnID":"authentication-ceremony","dfnText":"Authentication Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-ceremony"},{"id":"ref-for-authentication-ceremony\u2460"},{"id":"ref-for-authentication-ceremony\u2461"},{"id":"ref-for-authentication-ceremony\u2462"},{"id":"ref-for-authentication-ceremony\u2463"},{"id":"ref-for-authentication-ceremony\u2464"},{"id":"ref-for-authentication-ceremony\u2465"},{"id":"ref-for-authentication-ceremony\u2466"},{"id":"ref-for-authentication-ceremony\u2467"},{"id":"ref-for-authentication-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2462"},{"id":"ref-for-authentication-ceremony\u2460\u2463"},{"id":"ref-for-authentication-ceremony\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2460\u2466"},{"id":"ref-for-authentication-ceremony\u2460\u2467"},{"id":"ref-for-authentication-ceremony\u2460\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u24ea"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2460"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2462"},{"id":"ref-for-authentication-ceremony\u2461\u2463"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2464"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2461\u2465"},{"id":"ref-for-authentication-ceremony\u2461\u2466"},{"id":"ref-for-authentication-ceremony\u2461\u2467"},{"id":"ref-for-authentication-ceremony\u2461\u2468"},{"id":"ref-for-authentication-ceremony\u2462\u24ea"},{"id":"ref-for-authentication-ceremony\u2462\u2460"},{"id":"ref-for-authentication-ceremony\u2462\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2462"},{"id":"ref-for-authentication-ceremony\u2462\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2464"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2465"},{"id":"ref-for-authentication-ceremony\u2462\u2466"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authentication-ceremony\u2462\u2467"},{"id":"ref-for-authentication-ceremony\u2462\u2468"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u24ea"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2461"},{"id":"ref-for-authentication-ceremony\u2463\u2462"},{"id":"ref-for-authentication-ceremony\u2463\u2463"},{"id":"ref-for-authentication-ceremony\u2463\u2464"},{"id":"ref-for-authentication-ceremony\u2463\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2466"},{"id":"ref-for-authentication-ceremony\u2463\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authentication-ceremony\u2463\u2468"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#authentication-ceremony"},
 "authentication-extension": {"dfnID":"authentication-extension","dfnText":"authentication extension","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-extension"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authentication-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-authentication-extension\u2461"},{"id":"ref-for-authentication-extension\u2462"},{"id":"ref-for-authentication-extension\u2463"},{"id":"ref-for-authentication-extension\u2464"},{"id":"ref-for-authentication-extension\u2465"},{"id":"ref-for-authentication-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authentication-extension\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-authentication-extension\u2468"},{"id":"ref-for-authentication-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2460"},{"id":"ref-for-authentication-extension\u2460\u2461"},{"id":"ref-for-authentication-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authentication-extension\u2460\u2463"},{"id":"ref-for-authentication-extension\u2460\u2464"},{"id":"ref-for-authentication-extension\u2460\u2465"},{"id":"ref-for-authentication-extension\u2460\u2466"},{"id":"ref-for-authentication-extension\u2460\u2467"},{"id":"ref-for-authentication-extension\u2460\u2468"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u24ea"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2460"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2461"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-authentication-extension\u2461\u2462"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#authentication-extension"},
 "authentication-factor-capability": {"dfnID":"authentication-factor-capability","dfnText":"Authentication Factor Capability","external":false,"refSections":[{"refs":[{"id":"ref-for-authentication-factor-capability"},{"id":"ref-for-authentication-factor-capability\u2460"},{"id":"ref-for-authentication-factor-capability\u2461"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authentication-factor-capability"},
-"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"},{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2463"},{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"},{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2461"},{"id":"ref-for-authenticator\u2468\u2462"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2468\u2463"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2464"},{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"},{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"},{"id":"ref-for-authenticator\u2460\u24ea\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2460\u2461"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2460\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2465"},{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2461"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2463"},{"id":"ref-for-authenticator\u2460\u2461\u2464"},{"id":"ref-for-authenticator\u2460\u2461\u2465"},{"id":"ref-for-authenticator\u2460\u2461\u2466"},{"id":"ref-for-authenticator\u2460\u2461\u2467"},{"id":"ref-for-authenticator\u2460\u2461\u2468"},{"id":"ref-for-authenticator\u2460\u2462\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2460"},{"id":"ref-for-authenticator\u2460\u2462\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2462"},{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"},{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2467"},{"id":"ref-for-authenticator\u2460\u2462\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u24ea"},{"id":"ref-for-authenticator\u2460\u2463\u2460"},{"id":"ref-for-authenticator\u2460\u2463\u2461"},{"id":"ref-for-authenticator\u2460\u2463\u2462"},{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2467"},{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"},{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"},{"id":"ref-for-authenticator\u2460\u2464\u2462"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2463"},{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"},{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u24ea"},{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"},{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"},{"id":"ref-for-authenticator\u2460\u2466\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2464"},{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"},{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2462"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2463"},{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2460"},{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"},{"id":"ref-for-authenticator\u2460\u2468\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2465"},{"id":"ref-for-authenticator\u2460\u2468\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2467"},{"id":"ref-for-authenticator\u2460\u2468\u2468"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u24ea"},{"id":"ref-for-authenticator\u2461\u24ea\u2460"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"},{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"},{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"},{"id":"ref-for-authenticator\u2461\u2460\u2466"},{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2461\u2463"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2468"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u24ea"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2460"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2461"},{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"},{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u24ea"},{"id":"ref-for-authenticator\u2461\u2463\u2460"},{"id":"ref-for-authenticator\u2461\u2463\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2462"},{"id":"ref-for-authenticator\u2461\u2463\u2463"},{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2466"},{"id":"ref-for-authenticator\u2461\u2463\u2467"},{"id":"ref-for-authenticator\u2461\u2463\u2468"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u24ea"},{"id":"ref-for-authenticator\u2461\u2464\u2460"},{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"},{"id":"ref-for-authenticator\u2461\u2464\u2464"},{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"},{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2461"},{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"},{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"},{"id":"ref-for-authenticator\u2461\u2466\u2460"},{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2466"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2468"},{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"},{"id":"ref-for-authenticator\u2461\u2467\u2461"},{"id":"ref-for-authenticator\u2461\u2467\u2462"},{"id":"ref-for-authenticator\u2461\u2467\u2463"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2464"},{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"},{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2462"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2463"},{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"},{"id":"ref-for-authenticator\u2461\u2468\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2468"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u24ea"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2460"},{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"},{"id":"ref-for-authenticator\u2462\u24ea\u2463"},{"id":"ref-for-authenticator\u2462\u24ea\u2464"},{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2467"},{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2463"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2464"},{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"},{"id":"ref-for-authenticator\u2462\u2460\u2467"},{"id":"ref-for-authenticator\u2462\u2460\u2468"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u24ea"},{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"},{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2466"},{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2462\u2461"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2463"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
+"authenticator": {"dfnID":"authenticator","dfnText":"Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator\u2464"},{"id":"ref-for-authenticator\u2465"},{"id":"ref-for-authenticator\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-authenticator\u2467"},{"id":"ref-for-authenticator\u2468"},{"id":"ref-for-authenticator\u2460\u24ea"},{"id":"ref-for-authenticator\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2462"},{"id":"ref-for-authenticator\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465"}],"title":"1.2. Use Cases"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462"},{"id":"ref-for-authenticator\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2464"},{"id":"ref-for-authenticator\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2467"},{"id":"ref-for-authenticator\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462"},{"id":"ref-for-authenticator\u2462\u2463"},{"id":"ref-for-authenticator\u2462\u2464"},{"id":"ref-for-authenticator\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2467"},{"id":"ref-for-authenticator\u2462\u2468"},{"id":"ref-for-authenticator\u2463\u24ea"},{"id":"ref-for-authenticator\u2463\u2460"},{"id":"ref-for-authenticator\u2463\u2461"},{"id":"ref-for-authenticator\u2463\u2462"},{"id":"ref-for-authenticator\u2463\u2463"},{"id":"ref-for-authenticator\u2463\u2464"},{"id":"ref-for-authenticator\u2463\u2465"},{"id":"ref-for-authenticator\u2463\u2466"},{"id":"ref-for-authenticator\u2463\u2467"},{"id":"ref-for-authenticator\u2463\u2468"},{"id":"ref-for-authenticator\u2464\u24ea"},{"id":"ref-for-authenticator\u2464\u2460"},{"id":"ref-for-authenticator\u2464\u2461"},{"id":"ref-for-authenticator\u2464\u2462"},{"id":"ref-for-authenticator\u2464\u2463"},{"id":"ref-for-authenticator\u2464\u2464"},{"id":"ref-for-authenticator\u2464\u2465"},{"id":"ref-for-authenticator\u2464\u2466"},{"id":"ref-for-authenticator\u2464\u2467"},{"id":"ref-for-authenticator\u2464\u2468"},{"id":"ref-for-authenticator\u2465\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator\u2465\u2460"},{"id":"ref-for-authenticator\u2465\u2461"},{"id":"ref-for-authenticator\u2465\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-authenticator\u2465\u2463"},{"id":"ref-for-authenticator\u2465\u2464"},{"id":"ref-for-authenticator\u2465\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator\u2465\u2466"},{"id":"ref-for-authenticator\u2465\u2467"},{"id":"ref-for-authenticator\u2465\u2468"},{"id":"ref-for-authenticator\u2466\u24ea"},{"id":"ref-for-authenticator\u2466\u2460"},{"id":"ref-for-authenticator\u2466\u2461"},{"id":"ref-for-authenticator\u2466\u2462"},{"id":"ref-for-authenticator\u2466\u2463"},{"id":"ref-for-authenticator\u2466\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2466\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-authenticator\u2466\u2466"},{"id":"ref-for-authenticator\u2466\u2467"},{"id":"ref-for-authenticator\u2466\u2468"},{"id":"ref-for-authenticator\u2467\u24ea"},{"id":"ref-for-authenticator\u2467\u2460"},{"id":"ref-for-authenticator\u2467\u2461"},{"id":"ref-for-authenticator\u2467\u2462"},{"id":"ref-for-authenticator\u2467\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator\u2467\u2464"},{"id":"ref-for-authenticator\u2467\u2465"},{"id":"ref-for-authenticator\u2467\u2466"},{"id":"ref-for-authenticator\u2467\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2467\u2468"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u24ea"},{"id":"ref-for-authenticator\u2468\u2460"},{"id":"ref-for-authenticator\u2468\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2462"},{"id":"ref-for-authenticator\u2468\u2463"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authenticator\u2468\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-authenticator\u2468\u2465"},{"id":"ref-for-authenticator\u2468\u2466"},{"id":"ref-for-authenticator\u2468\u2467"},{"id":"ref-for-authenticator\u2468\u2468"},{"id":"ref-for-authenticator\u2460\u24ea\u24ea"},{"id":"ref-for-authenticator\u2460\u24ea\u2460"},{"id":"ref-for-authenticator\u2460\u24ea\u2461"},{"id":"ref-for-authenticator\u2460\u24ea\u2462"},{"id":"ref-for-authenticator\u2460\u24ea\u2463"},{"id":"ref-for-authenticator\u2460\u24ea\u2464"},{"id":"ref-for-authenticator\u2460\u24ea\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2466"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-authenticator\u2460\u24ea\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2460"},{"id":"ref-for-authenticator\u2460\u2460\u2461"},{"id":"ref-for-authenticator\u2460\u2460\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2463"},{"id":"ref-for-authenticator\u2460\u2460\u2464"},{"id":"ref-for-authenticator\u2460\u2460\u2465"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2460\u2466"},{"id":"ref-for-authenticator\u2460\u2460\u2467"},{"id":"ref-for-authenticator\u2460\u2460\u2468"},{"id":"ref-for-authenticator\u2460\u2461\u24ea"},{"id":"ref-for-authenticator\u2460\u2461\u2460"},{"id":"ref-for-authenticator\u2460\u2461\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2462"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2461\u2464"},{"id":"ref-for-authenticator\u2460\u2461\u2465"},{"id":"ref-for-authenticator\u2460\u2461\u2466"},{"id":"ref-for-authenticator\u2460\u2461\u2467"},{"id":"ref-for-authenticator\u2460\u2461\u2468"},{"id":"ref-for-authenticator\u2460\u2462\u24ea"},{"id":"ref-for-authenticator\u2460\u2462\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2461"},{"id":"ref-for-authenticator\u2460\u2462\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2463"},{"id":"ref-for-authenticator\u2460\u2462\u2464"},{"id":"ref-for-authenticator\u2460\u2462\u2465"},{"id":"ref-for-authenticator\u2460\u2462\u2466"},{"id":"ref-for-authenticator\u2460\u2462\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-authenticator\u2460\u2462\u2468"},{"id":"ref-for-authenticator\u2460\u2463\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2460"},{"id":"ref-for-authenticator\u2460\u2463\u2461"},{"id":"ref-for-authenticator\u2460\u2463\u2462"},{"id":"ref-for-authenticator\u2460\u2463\u2463"},{"id":"ref-for-authenticator\u2460\u2463\u2464"},{"id":"ref-for-authenticator\u2460\u2463\u2465"},{"id":"ref-for-authenticator\u2460\u2463\u2466"},{"id":"ref-for-authenticator\u2460\u2463\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authenticator\u2460\u2463\u2468"},{"id":"ref-for-authenticator\u2460\u2464\u24ea"},{"id":"ref-for-authenticator\u2460\u2464\u2460"},{"id":"ref-for-authenticator\u2460\u2464\u2461"},{"id":"ref-for-authenticator\u2460\u2464\u2462"},{"id":"ref-for-authenticator\u2460\u2464\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-authenticator\u2460\u2464\u2464"},{"id":"ref-for-authenticator\u2460\u2464\u2465"},{"id":"ref-for-authenticator\u2460\u2464\u2466"},{"id":"ref-for-authenticator\u2460\u2464\u2467"},{"id":"ref-for-authenticator\u2460\u2464\u2468"},{"id":"ref-for-authenticator\u2460\u2465\u24ea"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2465\u2460"},{"id":"ref-for-authenticator\u2460\u2465\u2461"},{"id":"ref-for-authenticator\u2460\u2465\u2462"},{"id":"ref-for-authenticator\u2460\u2465\u2463"},{"id":"ref-for-authenticator\u2460\u2465\u2464"},{"id":"ref-for-authenticator\u2460\u2465\u2465"},{"id":"ref-for-authenticator\u2460\u2465\u2466"},{"id":"ref-for-authenticator\u2460\u2465\u2467"},{"id":"ref-for-authenticator\u2460\u2465\u2468"},{"id":"ref-for-authenticator\u2460\u2466\u24ea"},{"id":"ref-for-authenticator\u2460\u2466\u2460"},{"id":"ref-for-authenticator\u2460\u2466\u2461"},{"id":"ref-for-authenticator\u2460\u2466\u2462"},{"id":"ref-for-authenticator\u2460\u2466\u2463"},{"id":"ref-for-authenticator\u2460\u2466\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-authenticator\u2460\u2466\u2465"},{"id":"ref-for-authenticator\u2460\u2466\u2466"},{"id":"ref-for-authenticator\u2460\u2466\u2467"},{"id":"ref-for-authenticator\u2460\u2466\u2468"},{"id":"ref-for-authenticator\u2460\u2467\u24ea"},{"id":"ref-for-authenticator\u2460\u2467\u2460"},{"id":"ref-for-authenticator\u2460\u2467\u2461"},{"id":"ref-for-authenticator\u2460\u2467\u2462"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2463"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator\u2460\u2467\u2464"},{"id":"ref-for-authenticator\u2460\u2467\u2465"},{"id":"ref-for-authenticator\u2460\u2467\u2466"},{"id":"ref-for-authenticator\u2460\u2467\u2467"},{"id":"ref-for-authenticator\u2460\u2467\u2468"},{"id":"ref-for-authenticator\u2460\u2468\u24ea"},{"id":"ref-for-authenticator\u2460\u2468\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2461"},{"id":"ref-for-authenticator\u2460\u2468\u2462"},{"id":"ref-for-authenticator\u2460\u2468\u2463"},{"id":"ref-for-authenticator\u2460\u2468\u2464"},{"id":"ref-for-authenticator\u2460\u2468\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2466"},{"id":"ref-for-authenticator\u2460\u2468\u2467"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-authenticator\u2460\u2468\u2468"},{"id":"ref-for-authenticator\u2461\u24ea\u24ea"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2460"},{"id":"ref-for-authenticator\u2461\u24ea\u2461"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2462"}],"title":"6.4.2. Language and Direction Encoding"},{"refs":[{"id":"ref-for-authenticator\u2461\u24ea\u2463"},{"id":"ref-for-authenticator\u2461\u24ea\u2464"},{"id":"ref-for-authenticator\u2461\u24ea\u2465"},{"id":"ref-for-authenticator\u2461\u24ea\u2466"},{"id":"ref-for-authenticator\u2461\u24ea\u2467"},{"id":"ref-for-authenticator\u2461\u24ea\u2468"},{"id":"ref-for-authenticator\u2461\u2460\u24ea"},{"id":"ref-for-authenticator\u2461\u2460\u2460"},{"id":"ref-for-authenticator\u2461\u2460\u2461"},{"id":"ref-for-authenticator\u2461\u2460\u2462"},{"id":"ref-for-authenticator\u2461\u2460\u2463"},{"id":"ref-for-authenticator\u2461\u2460\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2465"}],"title":"6.5.2. Attestation Statement Formats"},{"refs":[{"id":"ref-for-authenticator\u2461\u2460\u2466"},{"id":"ref-for-authenticator\u2461\u2460\u2467"},{"id":"ref-for-authenticator\u2461\u2460\u2468"},{"id":"ref-for-authenticator\u2461\u2461\u24ea"},{"id":"ref-for-authenticator\u2461\u2461\u2460"},{"id":"ref-for-authenticator\u2461\u2461\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2462"}],"title":"6.5.4. Generating an Attestation Object"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2463"},{"id":"ref-for-authenticator\u2461\u2461\u2464"}],"title":"6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2465"},{"id":"ref-for-authenticator\u2461\u2461\u2466"},{"id":"ref-for-authenticator\u2461\u2461\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authenticator\u2461\u2461\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u24ea"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2460"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2461"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2462"},{"id":"ref-for-authenticator\u2461\u2462\u2463"},{"id":"ref-for-authenticator\u2461\u2462\u2464"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-authenticator\u2461\u2462\u2466"},{"id":"ref-for-authenticator\u2461\u2462\u2467"},{"id":"ref-for-authenticator\u2461\u2462\u2468"},{"id":"ref-for-authenticator\u2461\u2463\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2460"},{"id":"ref-for-authenticator\u2461\u2463\u2461"},{"id":"ref-for-authenticator\u2461\u2463\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2463"},{"id":"ref-for-authenticator\u2461\u2463\u2464"},{"id":"ref-for-authenticator\u2461\u2463\u2465"},{"id":"ref-for-authenticator\u2461\u2463\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2463\u2467"},{"id":"ref-for-authenticator\u2461\u2463\u2468"},{"id":"ref-for-authenticator\u2461\u2464\u24ea"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-authenticator\u2461\u2464\u2460"},{"id":"ref-for-authenticator\u2461\u2464\u2461"},{"id":"ref-for-authenticator\u2461\u2464\u2462"},{"id":"ref-for-authenticator\u2461\u2464\u2463"},{"id":"ref-for-authenticator\u2461\u2464\u2464"},{"id":"ref-for-authenticator\u2461\u2464\u2465"},{"id":"ref-for-authenticator\u2461\u2464\u2466"},{"id":"ref-for-authenticator\u2461\u2464\u2467"},{"id":"ref-for-authenticator\u2461\u2464\u2468"},{"id":"ref-for-authenticator\u2461\u2465\u24ea"},{"id":"ref-for-authenticator\u2461\u2465\u2460"},{"id":"ref-for-authenticator\u2461\u2465\u2461"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2462"},{"id":"ref-for-authenticator\u2461\u2465\u2463"},{"id":"ref-for-authenticator\u2461\u2465\u2464"},{"id":"ref-for-authenticator\u2461\u2465\u2465"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2466"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-authenticator\u2461\u2465\u2467"},{"id":"ref-for-authenticator\u2461\u2465\u2468"},{"id":"ref-for-authenticator\u2461\u2466\u24ea"},{"id":"ref-for-authenticator\u2461\u2466\u2460"},{"id":"ref-for-authenticator\u2461\u2466\u2461"},{"id":"ref-for-authenticator\u2461\u2466\u2462"},{"id":"ref-for-authenticator\u2461\u2466\u2463"},{"id":"ref-for-authenticator\u2461\u2466\u2464"},{"id":"ref-for-authenticator\u2461\u2466\u2465"},{"id":"ref-for-authenticator\u2461\u2466\u2466"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2467"}],"title":"13.3. Security considerations for authenticators "},{"refs":[{"id":"ref-for-authenticator\u2461\u2466\u2468"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u24ea"},{"id":"ref-for-authenticator\u2461\u2467\u2460"},{"id":"ref-for-authenticator\u2461\u2467\u2461"},{"id":"ref-for-authenticator\u2461\u2467\u2462"},{"id":"ref-for-authenticator\u2461\u2467\u2463"},{"id":"ref-for-authenticator\u2461\u2467\u2464"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-authenticator\u2461\u2467\u2465"},{"id":"ref-for-authenticator\u2461\u2467\u2466"},{"id":"ref-for-authenticator\u2461\u2467\u2467"},{"id":"ref-for-authenticator\u2461\u2467\u2468"},{"id":"ref-for-authenticator\u2461\u2468\u24ea"},{"id":"ref-for-authenticator\u2461\u2468\u2460"},{"id":"ref-for-authenticator\u2461\u2468\u2461"},{"id":"ref-for-authenticator\u2461\u2468\u2462"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-authenticator\u2461\u2468\u2464"},{"id":"ref-for-authenticator\u2461\u2468\u2465"},{"id":"ref-for-authenticator\u2461\u2468\u2466"},{"id":"ref-for-authenticator\u2461\u2468\u2467"},{"id":"ref-for-authenticator\u2461\u2468\u2468"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2460"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2461"},{"id":"ref-for-authenticator\u2462\u24ea\u2462"},{"id":"ref-for-authenticator\u2462\u24ea\u2463"},{"id":"ref-for-authenticator\u2462\u24ea\u2464"},{"id":"ref-for-authenticator\u2462\u24ea\u2465"},{"id":"ref-for-authenticator\u2462\u24ea\u2466"},{"id":"ref-for-authenticator\u2462\u24ea\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-authenticator\u2462\u24ea\u2468"},{"id":"ref-for-authenticator\u2462\u2460\u24ea"},{"id":"ref-for-authenticator\u2462\u2460\u2460"},{"id":"ref-for-authenticator\u2462\u2460\u2461"},{"id":"ref-for-authenticator\u2462\u2460\u2462"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2464"}],"title":"14.4. Privacy considerations for authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2460\u2465"},{"id":"ref-for-authenticator\u2462\u2460\u2466"},{"id":"ref-for-authenticator\u2462\u2460\u2467"},{"id":"ref-for-authenticator\u2462\u2460\u2468"},{"id":"ref-for-authenticator\u2462\u2461\u24ea"}],"title":"14.4.1. Attestation Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2460"},{"id":"ref-for-authenticator\u2462\u2461\u2461"},{"id":"ref-for-authenticator\u2462\u2461\u2462"},{"id":"ref-for-authenticator\u2462\u2461\u2463"},{"id":"ref-for-authenticator\u2462\u2461\u2464"},{"id":"ref-for-authenticator\u2462\u2461\u2465"},{"id":"ref-for-authenticator\u2462\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-authenticator\u2462\u2461\u2467"},{"id":"ref-for-authenticator\u2462\u2461\u2468"},{"id":"ref-for-authenticator\u2462\u2462\u24ea"},{"id":"ref-for-authenticator\u2462\u2462\u2460"},{"id":"ref-for-authenticator\u2462\u2462\u2461"},{"id":"ref-for-authenticator\u2462\u2462\u2462"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2463"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2465"},{"id":"ref-for-authenticator\u2462\u2462\u2466"},{"id":"ref-for-authenticator\u2462\u2462\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-authenticator\u2462\u2462\u2468"}],"title":"15. Accessibility Considerations"}],"url":"#authenticator"},
 "authenticator-attachment-modality": {"dfnID":"authenticator-attachment-modality","dfnText":"Authenticator Attachment Modality","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-attachment-modality"},{"id":"ref-for-authenticator-attachment-modality\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2465"},{"id":"ref-for-authenticator-attachment-modality\u2466"},{"id":"ref-for-authenticator-attachment-modality\u2467"},{"id":"ref-for-authenticator-attachment-modality\u2468"},{"id":"ref-for-authenticator-attachment-modality\u2460\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-authenticator-attachment-modality\u2460\u2460"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2461"},{"id":"ref-for-authenticator-attachment-modality\u2460\u2462"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#authenticator-attachment-modality"},
 "authenticator-configuration": {"dfnID":"authenticator-configuration","dfnText":"Authenticator Configuration","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-configuration"},{"id":"ref-for-authenticator-configuration\u2460"},{"id":"ref-for-authenticator-configuration\u2461"},{"id":"ref-for-authenticator-configuration\u2462"}],"title":"11.3. Add Virtual Authenticator"}],"url":"#authenticator-configuration"},
 "authenticator-credentials-map": {"dfnID":"authenticator-credentials-map","dfnText":"credentials map","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticator-credentials-map"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2460"}],"title":"6.3.1. Lookup Credential Source by Credential ID Algorithm"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2462"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authenticator-credentials-map\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#authenticator-credentials-map"},
@@ -11382,8 +11468,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authenticatorresponse": {"dfnID":"authenticatorresponse","dfnText":"AuthenticatorResponse","external":false,"refSections":[{"refs":[{"id":"ref-for-authenticatorresponse"},{"id":"ref-for-authenticatorresponse\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-authenticatorresponse\u2461"},{"id":"ref-for-authenticatorresponse\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2463"},{"id":"ref-for-authenticatorresponse\u2464"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-authenticatorresponse\u2465"},{"id":"ref-for-authenticatorresponse\u2466"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"#authenticatorresponse"},
 "authorization-gesture": {"dfnID":"authorization-gesture","dfnText":"Authorization Gesture","external":false,"refSections":[{"refs":[{"id":"ref-for-authorization-gesture"}],"title":"1.2.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2460"}],"title":"1.2.2. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2461"},{"id":"ref-for-authorization-gesture\u2462"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2463"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-authorization-gesture\u2464"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-authorization-gesture\u2465"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-authorization-gesture\u2466"},{"id":"ref-for-authorization-gesture\u2467"},{"id":"ref-for-authorization-gesture\u2468"},{"id":"ref-for-authorization-gesture\u2460\u24ea"},{"id":"ref-for-authorization-gesture\u2460\u2460"},{"id":"ref-for-authorization-gesture\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2462"},{"id":"ref-for-authorization-gesture\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authorization-gesture\u2460\u2465"},{"id":"ref-for-authorization-gesture\u2460\u2466"},{"id":"ref-for-authorization-gesture\u2460\u2467"},{"id":"ref-for-authorization-gesture\u2460\u2468"},{"id":"ref-for-authorization-gesture\u2461\u24ea"},{"id":"ref-for-authorization-gesture\u2461\u2460"},{"id":"ref-for-authorization-gesture\u2461\u2461"},{"id":"ref-for-authorization-gesture\u2461\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2463"},{"id":"ref-for-authorization-gesture\u2461\u2464"},{"id":"ref-for-authorization-gesture\u2461\u2465"},{"id":"ref-for-authorization-gesture\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2467"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authorization-gesture\u2461\u2468"}],"title":"15. Accessibility Considerations"}],"url":"#authorization-gesture"},
 "b05bf85d": {"dfnID":"b05bf85d","dfnText":"buffer source types","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-buffer-source-type"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dfn-buffer-source-type\u2460"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}],"url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
-"b0d7f3c3": {"dfnID":"b0d7f3c3","dfnText":"USVString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-USVString"},{"id":"ref-for-idl-USVString\u2460"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-USVString\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-USVString\u2462"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-USVString\u2463"},{"id":"ref-for-idl-USVString\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-USVString\u2465"},{"id":"ref-for-idl-USVString\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-USVString"},
-"b0f5bc03": {"dfnID":"b0f5bc03","dfnText":"create()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-create"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2464"},{"id":"ref-for-dom-credentialscontainer-create\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2466"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2463"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2464"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2465"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2468"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2464"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2465"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2466"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2463"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2464"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2465"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2466"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2467"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2468"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2463\u24ea"}],"title":"11.6. Get Credentials"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
+"b0d7f3c3": {"dfnID":"b0d7f3c3","dfnText":"USVString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-USVString"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-USVString\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-USVString\u2461"},{"id":"ref-for-idl-USVString\u2462"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-USVString\u2463"},{"id":"ref-for-idl-USVString\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://webidl.spec.whatwg.org/#idl-USVString"},
+"b0f5bc03": {"dfnID":"b0f5bc03","dfnText":"create()","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialscontainer-create"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2464"},{"id":"ref-for-dom-credentialscontainer-create\u2465"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2466"}],"title":"5.1.1. CredentialCreationOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2467"},{"id":"ref-for-dom-credentialscontainer-create\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2463"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2465"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2466"},{"id":"ref-for-dom-credentialscontainer-create\u2460\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2460\u2468"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u24ea"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2461"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2462"},{"id":"ref-for-dom-credentialscontainer-create\u2461\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2464"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2466"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2467"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2461\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u24ea"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2460"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2461"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2462"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2463"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2464"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2465"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2466"},{"id":"ref-for-dom-credentialscontainer-create\u2462\u2467"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2462\u2468"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2463\u24ea"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-dom-credentialscontainer-create\u2463\u2460"}],"title":"11.6. Get Credentials"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create"},
 "b0f631d2": {"dfnID":"b0f631d2","dfnText":"willful violation","external":true,"refSections":[{"refs":[{"id":"ref-for-willful-violation"}],"title":"4. Terminology"}],"url":"https://infra.spec.whatwg.org/#willful-violation"},
 "b0fcb8d7": {"dfnID":"b0fcb8d7","dfnText":"utf-8 decode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-decode"},{"id":"ref-for-utf-8-decode\u2460"},{"id":"ref-for-utf-8-decode\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-utf-8-decode\u2462"},{"id":"ref-for-utf-8-decode\u2463"},{"id":"ref-for-utf-8-decode\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
 "b2ac942d": {"dfnID":"b2ac942d","dfnText":"section 2.1","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2.1"}],"title":"5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"},{"refs":[{"id":"ref-for-section-2.1\u2465"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc9053#section-2.1"},
@@ -11392,7 +11478,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "b705e53a": {"dfnID":"b705e53a","dfnText":"man-in-the-middle attack","external":true,"refSections":[{"refs":[{"id":"ref-for-page-186"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-page-186\u2460"},{"id":"ref-for-page-186\u2461"},{"id":"ref-for-page-186\u2462"},{"id":"ref-for-page-186\u2463"},{"id":"ref-for-page-186\u2464"},{"id":"ref-for-page-186\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-page-186\u2466"}],"title":"13.4.8. Code injection attacks"}],"url":"https://tools.ietf.org/html/rfc4949#page-186"},
 "b75bb3bd": {"dfnID":"b75bb3bd","dfnText":"SecureContext","external":true,"refSections":[{"refs":[{"id":"ref-for-SecureContext"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-SecureContext\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-SecureContext\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-SecureContext\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#SecureContext"},
 "b85ee3be": {"dfnID":"b85ee3be","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-host"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-host\u2460"},{"id":"ref-for-concept-url-host\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-url-host\u2462"},{"id":"ref-for-concept-url-host\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-url-host"},
-"ba556545": {"dfnID":"ba556545","dfnText":"NotAllowedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notallowederror"},{"id":"ref-for-notallowederror\u2460"},{"id":"ref-for-notallowederror\u2461"},{"id":"ref-for-notallowederror\u2462"},{"id":"ref-for-notallowederror\u2463"},{"id":"ref-for-notallowederror\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2465"},{"id":"ref-for-notallowederror\u2466"},{"id":"ref-for-notallowederror\u2467"},{"id":"ref-for-notallowederror\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u24ea"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2461"},{"id":"ref-for-notallowederror\u2460\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2463"},{"id":"ref-for-notallowederror\u2460\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#notallowederror"},
+"ba556545": {"dfnID":"ba556545","dfnText":"NotAllowedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notallowederror"},{"id":"ref-for-notallowederror\u2460"},{"id":"ref-for-notallowederror\u2461"},{"id":"ref-for-notallowederror\u2462"},{"id":"ref-for-notallowederror\u2463"},{"id":"ref-for-notallowederror\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2466"},{"id":"ref-for-notallowederror\u2467"},{"id":"ref-for-notallowederror\u2468"},{"id":"ref-for-notallowederror\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2463"},{"id":"ref-for-notallowederror\u2460\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2465"},{"id":"ref-for-notallowederror\u2460\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#notallowederror"},
 "ba9c2b34": {"dfnID":"ba9c2b34","dfnText":"single-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-sf"}],"title":"6.2. Authenticator Taxonomy"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf"},
 "backed-up": {"dfnID":"backed-up","dfnText":"Backed Up","external":false,"refSections":[{"refs":[{"id":"ref-for-backed-up"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backed-up\u2460"},{"id":"ref-for-backed-up\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backed-up\u2462"},{"id":"ref-for-backed-up\u2463"}],"title":"6.1.3. Credential Backup State"}],"url":"#backed-up"},
 "backup-eligibility": {"dfnID":"backup-eligibility","dfnText":"Backup Eligibility","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligibility"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backup-eligibility\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-eligibility\u2461"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-backup-eligibility\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-backup-eligibility\u2464"},{"id":"ref-for-backup-eligibility\u2465"},{"id":"ref-for-backup-eligibility\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2467"},{"id":"ref-for-backup-eligibility\u2468"}],"title":"11.10. Set Credential Properties"}],"url":"#backup-eligibility"},
@@ -11412,7 +11498,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "bound-credential": {"dfnID":"bound-credential","dfnText":"Bound credential","external":false,"refSections":[{"refs":[{"id":"ref-for-bound-credential\u2460"},{"id":"ref-for-bound-credential\u2461"},{"id":"ref-for-bound-credential\u2462"},{"id":"ref-for-bound-credential\u2463"},{"id":"ref-for-bound-credential\u2464"},{"id":"ref-for-bound-credential\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-bound-credential\u2466"},{"id":"ref-for-bound-credential\u2467"},{"id":"ref-for-bound-credential\u2468"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-bound-credential\u2460\u24ea"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2460"},{"id":"ref-for-bound-credential\u2460\u2461"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2462"},{"id":"ref-for-bound-credential\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2464"},{"id":"ref-for-bound-credential\u2460\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-bound-credential\u2460\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#bound-credential"},
 "c15f1628": {"dfnID":"c15f1628","dfnText":"internal slot","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461\u24ea"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
 "c1f02de3": {"dfnID":"c1f02de3","dfnText":"salt","external":true,"refSections":[{"refs":[{"id":"ref-for-page-258"},{"id":"ref-for-page-258\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"https://tools.ietf.org/html/rfc4949#page-258"},
-"c3e881ef": {"dfnID":"c3e881ef","dfnText":"SecurityError","external":true,"refSections":[{"refs":[{"id":"ref-for-securityerror"},{"id":"ref-for-securityerror\u2460"},{"id":"ref-for-securityerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2462"},{"id":"ref-for-securityerror\u2463"},{"id":"ref-for-securityerror\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2465"},{"id":"ref-for-securityerror\u2466"},{"id":"ref-for-securityerror\u2467"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-securityerror\u2468"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-securityerror\u2460\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#securityerror"},
+"c3e881ef": {"dfnID":"c3e881ef","dfnText":"SecurityError","external":true,"refSections":[{"refs":[{"id":"ref-for-securityerror"},{"id":"ref-for-securityerror\u2460"},{"id":"ref-for-securityerror\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2463"},{"id":"ref-for-securityerror\u2464"},{"id":"ref-for-securityerror\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-securityerror\u2466"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-securityerror\u2467"},{"id":"ref-for-securityerror\u2468"},{"id":"ref-for-securityerror\u2460\u24ea"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-securityerror\u2460\u2460"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-securityerror\u2460\u2461"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}],"url":"https://webidl.spec.whatwg.org/#securityerror"},
 "c63519ed": {"dfnID":"c63519ed","dfnText":"top-level origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-environment-top-level-origin"},{"id":"ref-for-concept-environment-top-level-origin\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-environment-top-level-origin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin"},
 "c88f3887": {"dfnID":"c88f3887","dfnText":"item (for struct)","external":true,"refSections":[{"refs":[{"id":"ref-for-struct-item"},{"id":"ref-for-struct-item\u2460"},{"id":"ref-for-struct-item\u2461"},{"id":"ref-for-struct-item\u2462"},{"id":"ref-for-struct-item\u2463"},{"id":"ref-for-struct-item\u2464"},{"id":"ref-for-struct-item\u2465"},{"id":"ref-for-struct-item\u2466"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct-item\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct-item\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-struct-item\u2460\u24ea"},{"id":"ref-for-struct-item\u2460\u2460"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-struct-item\u2460\u2461"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-struct-item\u2460\u2462"},{"id":"ref-for-struct-item\u2460\u2463"}],"title":"10.2.1.3. supplementalPubKeys Extension Output Verification Procedures"}],"url":"https://infra.spec.whatwg.org/#struct-item"},
 "ca3ca4ae": {"dfnID":"ca3ca4ae","dfnText":"url parser","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-parser"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://url.spec.whatwg.org/#concept-url-parser"},
@@ -11428,7 +11514,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "cece9985": {"dfnID":"cece9985","dfnText":"kty","external":true,"refSections":[{"refs":[{"id":"ref-for-name-cose-key-common-parameters"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
 "ceremony": {"dfnID":"ceremony","dfnText":"Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-ceremony"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-ceremony\u2460"},{"id":"ref-for-ceremony\u2461"},{"id":"ref-for-ceremony\u2462"},{"id":"ref-for-ceremony\u2463"},{"id":"ref-for-ceremony\u2464"},{"id":"ref-for-ceremony\u2465"},{"id":"ref-for-ceremony\u2466"},{"id":"ref-for-ceremony\u2467"},{"id":"ref-for-ceremony\u2468"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-ceremony\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-ceremony\u2460\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-ceremony\u2460\u2461"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-ceremony\u2460\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-ceremony\u2460\u2465"},{"id":"ref-for-ceremony\u2460\u2466"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-ceremony\u2460\u2467"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#ceremony"},
 "cfc67fdc": {"dfnID":"cfc67fdc","dfnText":"empty host","external":true,"refSections":[{"refs":[{"id":"ref-for-empty-host"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-empty-host\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#empty-host"},
-"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-client\u2461\u2463"},{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u24ea"},{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"},{"id":"ref-for-client\u2462\u2463"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"},{"id":"ref-for-client\u2462\u2466"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"},{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"},{"id":"ref-for-client\u2463\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2463\u2462"},{"id":"ref-for-client\u2463\u2463"},{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2463\u2468"},{"id":"ref-for-client\u2464\u24ea"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"},{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2464\u2464"},{"id":"ref-for-client\u2464\u2465"},{"id":"ref-for-client\u2464\u2466"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2464\u2467"},{"id":"ref-for-client\u2464\u2468"},{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"},{"id":"ref-for-client\u2465\u2461"},{"id":"ref-for-client\u2465\u2462"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2465\u2463"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2465\u2464"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2465\u2465"},{"id":"ref-for-client\u2465\u2466"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2465\u2467"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2465\u2468"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u24ea"},{"id":"ref-for-client\u2466\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2466\u2461"},{"id":"ref-for-client\u2466\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2466\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2466\u2464"},{"id":"ref-for-client\u2466\u2465"},{"id":"ref-for-client\u2466\u2466"},{"id":"ref-for-client\u2466\u2467"},{"id":"ref-for-client\u2466\u2468"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u24ea"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2460"},{"id":"ref-for-client\u2467\u2461"},{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2467\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2467\u2465"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2467\u2466"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2467\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2467\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2468\u24ea"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2468\u2460"},{"id":"ref-for-client\u2468\u2461"},{"id":"ref-for-client\u2468\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2468\u2463"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2468\u2464"},{"id":"ref-for-client\u2468\u2465"},{"id":"ref-for-client\u2468\u2466"},{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u24ea"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2461"},{"id":"ref-for-client\u2460\u24ea\u2462"},{"id":"ref-for-client\u2460\u24ea\u2463"},{"id":"ref-for-client\u2460\u24ea\u2464"},{"id":"ref-for-client\u2460\u24ea\u2465"},{"id":"ref-for-client\u2460\u24ea\u2466"},{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u24ea"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2460"},{"id":"ref-for-client\u2460\u2460\u2461"},{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2465"},{"id":"ref-for-client\u2460\u2460\u2466"},{"id":"ref-for-client\u2460\u2460\u2467"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2468"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u24ea"},{"id":"ref-for-client\u2460\u2461\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2461"}],"title":"14.5. Privacy considerations for clients"}],"url":"#client"},
+"client": {"dfnID":"client","dfnText":"Client","external":false,"refSections":[{"refs":[{"id":"ref-for-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-client\u2460"},{"id":"ref-for-client\u2461"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-client\u2462"},{"id":"ref-for-client\u2463"},{"id":"ref-for-client\u2464"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-client\u2465"},{"id":"ref-for-client\u2466"},{"id":"ref-for-client\u2467"},{"id":"ref-for-client\u2468"},{"id":"ref-for-client\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460"},{"id":"ref-for-client\u2460\u2461"},{"id":"ref-for-client\u2460\u2462"},{"id":"ref-for-client\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client\u2460\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-client\u2460\u2465"},{"id":"ref-for-client\u2460\u2466"},{"id":"ref-for-client\u2460\u2467"},{"id":"ref-for-client\u2460\u2468"},{"id":"ref-for-client\u2461\u24ea"},{"id":"ref-for-client\u2461\u2460"},{"id":"ref-for-client\u2461\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-client\u2461\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-client\u2461\u2464"},{"id":"ref-for-client\u2461\u2465"},{"id":"ref-for-client\u2461\u2466"},{"id":"ref-for-client\u2461\u2467"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client\u2461\u2468"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-client\u2462\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-client\u2462\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-client\u2462\u2461"},{"id":"ref-for-client\u2462\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-client\u2462\u2463"},{"id":"ref-for-client\u2462\u2464"},{"id":"ref-for-client\u2462\u2465"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-client\u2462\u2466"},{"id":"ref-for-client\u2462\u2467"},{"id":"ref-for-client\u2462\u2468"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-client\u2463\u24ea"},{"id":"ref-for-client\u2463\u2460"},{"id":"ref-for-client\u2463\u2461"},{"id":"ref-for-client\u2463\u2462"},{"id":"ref-for-client\u2463\u2463"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-client\u2463\u2464"},{"id":"ref-for-client\u2463\u2465"},{"id":"ref-for-client\u2463\u2466"},{"id":"ref-for-client\u2463\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-client\u2463\u2468"},{"id":"ref-for-client\u2464\u24ea"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-client\u2464\u2460"},{"id":"ref-for-client\u2464\u2461"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client\u2464\u2462"},{"id":"ref-for-client\u2464\u2463"},{"id":"ref-for-client\u2464\u2464"},{"id":"ref-for-client\u2464\u2465"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-client\u2464\u2466"},{"id":"ref-for-client\u2464\u2467"},{"id":"ref-for-client\u2464\u2468"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-client\u2465\u24ea"},{"id":"ref-for-client\u2465\u2460"},{"id":"ref-for-client\u2465\u2461"},{"id":"ref-for-client\u2465\u2462"},{"id":"ref-for-client\u2465\u2463"},{"id":"ref-for-client\u2465\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-client\u2465\u2465"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-client\u2465\u2466"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-client\u2465\u2467"},{"id":"ref-for-client\u2465\u2468"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-client\u2466\u24ea"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client\u2466\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-client\u2466\u2461"},{"id":"ref-for-client\u2466\u2462"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client\u2466\u2463"},{"id":"ref-for-client\u2466\u2464"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client\u2466\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client\u2466\u2466"},{"id":"ref-for-client\u2466\u2467"},{"id":"ref-for-client\u2466\u2468"},{"id":"ref-for-client\u2467\u24ea"},{"id":"ref-for-client\u2467\u2460"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client\u2467\u2461"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client\u2467\u2462"},{"id":"ref-for-client\u2467\u2463"},{"id":"ref-for-client\u2467\u2464"},{"id":"ref-for-client\u2467\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-client\u2467\u2466"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-client\u2467\u2467"}],"title":"6.4.1. String Truncation"},{"refs":[{"id":"ref-for-client\u2467\u2468"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-client\u2468\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client\u2468\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client\u2468\u2461"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client\u2468\u2462"},{"id":"ref-for-client\u2468\u2463"},{"id":"ref-for-client\u2468\u2464"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client\u2468\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client\u2468\u2466"},{"id":"ref-for-client\u2468\u2467"},{"id":"ref-for-client\u2468\u2468"},{"id":"ref-for-client\u2460\u24ea\u24ea"},{"id":"ref-for-client\u2460\u24ea\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-client\u2460\u24ea\u2463"},{"id":"ref-for-client\u2460\u24ea\u2464"},{"id":"ref-for-client\u2460\u24ea\u2465"},{"id":"ref-for-client\u2460\u24ea\u2466"},{"id":"ref-for-client\u2460\u24ea\u2467"},{"id":"ref-for-client\u2460\u24ea\u2468"},{"id":"ref-for-client\u2460\u2460\u24ea"},{"id":"ref-for-client\u2460\u2460\u2460"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2461"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2462"},{"id":"ref-for-client\u2460\u2460\u2463"},{"id":"ref-for-client\u2460\u2460\u2464"},{"id":"ref-for-client\u2460\u2460\u2465"},{"id":"ref-for-client\u2460\u2460\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-client\u2460\u2460\u2467"},{"id":"ref-for-client\u2460\u2460\u2468"},{"id":"ref-for-client\u2460\u2461\u24ea"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2460"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2461"},{"id":"ref-for-client\u2460\u2461\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-client\u2460\u2461\u2463"}],"title":"14.5. Privacy considerations for clients"}],"url":"#client"},
 "client-data": {"dfnID":"client-data","dfnText":"client data","external":false,"refSections":[{"refs":[{"id":"ref-for-client-data"},{"id":"ref-for-client-data\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-client-data\u2461"},{"id":"ref-for-client-data\u2462"},{"id":"ref-for-client-data\u2463"},{"id":"ref-for-client-data\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-data\u2465"},{"id":"ref-for-client-data\u2466"},{"id":"ref-for-client-data\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-client-data\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-data\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-data\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2461"}],"title":"8.8. Apple Anonymous Attestation Statement Format"},{"refs":[{"id":"ref-for-client-data\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-data\u2460\u2463"},{"id":"ref-for-client-data\u2460\u2464"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#client-data"},
 "client-device": {"dfnID":"client-device","dfnText":"Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-client-device"},{"id":"ref-for-client-device\u2460"},{"id":"ref-for-client-device\u2461"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-client-device\u2462"}],"title":"1.3. Sample API Usage Scenarios"},{"refs":[{"id":"ref-for-client-device\u2463"},{"id":"ref-for-client-device\u2464"},{"id":"ref-for-client-device\u2465"},{"id":"ref-for-client-device\u2466"},{"id":"ref-for-client-device\u2467"},{"id":"ref-for-client-device\u2468"},{"id":"ref-for-client-device\u2460\u24ea"},{"id":"ref-for-client-device\u2460\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-client-device\u2460\u2461"},{"id":"ref-for-client-device\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2463"},{"id":"ref-for-client-device\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-device\u2460\u2465"},{"id":"ref-for-client-device\u2460\u2466"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-client-device\u2460\u2467"},{"id":"ref-for-client-device\u2460\u2468"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-client-device\u2461\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-client-device\u2461\u2460"},{"id":"ref-for-client-device\u2461\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-client-device\u2461\u2462"},{"id":"ref-for-client-device\u2461\u2463"},{"id":"ref-for-client-device\u2461\u2464"},{"id":"ref-for-client-device\u2461\u2465"},{"id":"ref-for-client-device\u2461\u2466"},{"id":"ref-for-client-device\u2461\u2467"},{"id":"ref-for-client-device\u2461\u2468"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-client-device\u2462\u24ea"},{"id":"ref-for-client-device\u2462\u2460"},{"id":"ref-for-client-device\u2462\u2461"},{"id":"ref-for-client-device\u2462\u2462"},{"id":"ref-for-client-device\u2462\u2463"},{"id":"ref-for-client-device\u2462\u2464"},{"id":"ref-for-client-device\u2462\u2465"},{"id":"ref-for-client-device\u2462\u2466"},{"id":"ref-for-client-device\u2462\u2467"},{"id":"ref-for-client-device\u2462\u2468"},{"id":"ref-for-client-device\u2463\u24ea"},{"id":"ref-for-client-device\u2463\u2460"},{"id":"ref-for-client-device\u2463\u2461"},{"id":"ref-for-client-device\u2463\u2462"}],"title":"6.2.1. Authenticator Attachment Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-client-device\u2463\u2464"},{"id":"ref-for-client-device\u2463\u2465"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-client-device\u2463\u2466"},{"id":"ref-for-client-device\u2463\u2467"}],"title":"14.5.3. Privacy Between Operating System Accounts"}],"url":"#client-device"},
 "client-extension": {"dfnID":"client-extension","dfnText":"client extension","external":false,"refSections":[{"refs":[{"id":"ref-for-client-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-client-extension\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-client-extension\u2462"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-client-extension\u2463"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-client-extension\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-client-extension\u2465"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-client-extension\u2466"}],"title":"10.1. Client Extensions"},{"refs":[{"id":"ref-for-client-extension\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-client-extension\u2468"},{"id":"ref-for-client-extension\u2460\u24ea"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-client-extension\u2460\u2461"}],"title":"10.2. Authenticator Extensions"},{"refs":[{"id":"ref-for-client-extension\u2460\u2462"},{"id":"ref-for-client-extension\u2460\u2463"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#client-extension"},
@@ -11470,6 +11556,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "d0140610": {"dfnID":"d0140610","dfnText":"remote","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-discovery-remote"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote"},
 "d14a6f26": {"dfnID":"d14a6f26","dfnText":"key","external":true,"refSections":[{"refs":[{"id":"ref-for-map-key"},{"id":"ref-for-map-key\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-key"},
 "d18b257e": {"dfnID":"d18b257e","dfnText":"[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-credential-collectfromcredentialstore-slot\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot"},
+"d25dfb2c": {"dfnID":"d25dfb2c","dfnText":"AbortError","external":true,"refSections":[{"refs":[{"id":"ref-for-aborterror"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-aborterror\u2460"}],"title":"5.1.4.3. Get Request Exceptions"}],"url":"https://webidl.spec.whatwg.org/#aborterror"},
 "d3801403": {"dfnID":"d3801403","dfnText":"\u00a76. authenticator api","external":true,"refSections":[{"refs":[{"id":"ref-for-authenticator-api"}],"title":"6. WebAuthn Authenticator Model"}],"url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
 "d3ddece3": {"dfnID":"d3ddece3","dfnText":"group sockets","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.9"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-section-3.9\u2460"},{"id":"ref-for-section-3.9\u2461"}],"title":"10.2.1.2. Extension Definition"}],"url":"https://tools.ietf.org/html/rfc8610#section-3.9"},
 "d6e2b0d9": {"dfnID":"d6e2b0d9","dfnText":"ipv6 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv6"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-ipv6\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv6"},
@@ -11478,7 +11565,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "d7d642a2": {"dfnID":"d7d642a2","dfnText":"input","external":true,"refSections":[{"refs":[{"id":"ref-for-the-input-element"},{"id":"ref-for-the-input-element\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/input.html#the-input-element"},
 "d9070155": {"dfnID":"d9070155","dfnText":"CredentialRequestOptions","external":true,"refSections":[{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions"},{"id":"ref-for-dictdef-credentialrequestoptions\u2460"}],"title":"5.1.2. CredentialRequestOptions Dictionary Extension"},{"refs":[{"id":"ref-for-dictdef-credentialrequestoptions\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions"},
 "dbde7f99": {"dfnID":"dbde7f99","dfnText":"ipv4 address","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-ipv4"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-ipv4\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-ipv4"},
-"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"},{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"},{"id":"ref-for-idl-DOMException\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2462"},{"id":"ref-for-idl-DOMException\u2460\u2463"},{"id":"ref-for-idl-DOMException\u2460\u2464"},{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"},{"id":"ref-for-idl-DOMException\u2460\u2467"},{"id":"ref-for-idl-DOMException\u2460\u2468"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u24ea"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2460"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2461"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2462"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2464"},{"id":"ref-for-idl-DOMException\u2461\u2465"},{"id":"ref-for-idl-DOMException\u2461\u2466"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2467"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u24ea"},{"id":"ref-for-idl-DOMException\u2462\u2460"},{"id":"ref-for-idl-DOMException\u2462\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2462"},{"id":"ref-for-idl-DOMException\u2462\u2463"},{"id":"ref-for-idl-DOMException\u2462\u2464"},{"id":"ref-for-idl-DOMException\u2462\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
+"dca2de17": {"dfnID":"dca2de17","dfnText":"DOMException","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMException"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-idl-DOMException\u2460"},{"id":"ref-for-idl-DOMException\u2461"},{"id":"ref-for-idl-DOMException\u2462"},{"id":"ref-for-idl-DOMException\u2463"},{"id":"ref-for-idl-DOMException\u2464"},{"id":"ref-for-idl-DOMException\u2465"},{"id":"ref-for-idl-DOMException\u2466"},{"id":"ref-for-idl-DOMException\u2467"},{"id":"ref-for-idl-DOMException\u2468"},{"id":"ref-for-idl-DOMException\u2460\u24ea"},{"id":"ref-for-idl-DOMException\u2460\u2460"},{"id":"ref-for-idl-DOMException\u2460\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-idl-DOMException\u2460\u2463"},{"id":"ref-for-idl-DOMException\u2460\u2464"},{"id":"ref-for-idl-DOMException\u2460\u2465"},{"id":"ref-for-idl-DOMException\u2460\u2466"},{"id":"ref-for-idl-DOMException\u2460\u2467"},{"id":"ref-for-idl-DOMException\u2460\u2468"},{"id":"ref-for-idl-DOMException\u2461\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2461"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2462"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMException\u2461\u2466"},{"id":"ref-for-idl-DOMException\u2461\u2467"},{"id":"ref-for-idl-DOMException\u2461\u2468"}],"title":"5.11.1. Validating Related Origins"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u24ea"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2460"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2461"},{"id":"ref-for-idl-DOMException\u2462\u2462"},{"id":"ref-for-idl-DOMException\u2462\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-idl-DOMException\u2462\u2464"},{"id":"ref-for-idl-DOMException\u2462\u2465"},{"id":"ref-for-idl-DOMException\u2462\u2466"},{"id":"ref-for-idl-DOMException\u2462\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMException"},
 "dd460c8e": {"dfnID":"dd460c8e","dfnText":"is not empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-is-empty"},{"id":"ref-for-list-is-empty\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-is-empty\u2461"},{"id":"ref-for-list-is-empty\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2463"},{"id":"ref-for-list-is-empty\u2464"},{"id":"ref-for-list-is-empty\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-list-is-empty\u2466"},{"id":"ref-for-list-is-empty\u2467"},{"id":"ref-for-list-is-empty\u2468"},{"id":"ref-for-list-is-empty\u2460\u24ea"},{"id":"ref-for-list-is-empty\u2460\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-list-is-empty\u2460\u2462"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"https://infra.spec.whatwg.org/#list-is-empty"},
 "determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised": {"dfnID":"determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised","dfnText":"determines the set of origins on which the public key credential may be exercised","external":false,"refSections":[{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2460"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2461"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2462"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2464"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2465"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2466"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2467"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2468"},{"id":"ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised\u2460\u24ea"}],"title":"13.4.8. Code injection attacks"}],"url":"#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised"},
 "df6ef2f0": {"dfnID":"df6ef2f0","dfnText":"section 2","external":true,"refSections":[{"refs":[{"id":"ref-for-section-2\u2460"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}],"url":"https://tools.ietf.org/html/rfc8230#section-2"},
@@ -11580,8 +11667,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-authenticatorresponse-clientdatajson": {"dfnID":"dom-authenticatorresponse-clientdatajson","dfnText":"clientDataJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2462"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2464"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2465"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2466"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2467"},{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-authenticatorresponse-clientdatajson\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-authenticatorresponse-clientdatajson"},
 "dom-authenticatorselectioncriteria-authenticatorattachment": {"dfnID":"dom-authenticatorselectioncriteria-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2460"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2463"},{"id":"ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2464"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-authenticatorselectioncriteria-authenticatorattachment"},
 "dom-authenticatorselectioncriteria-requireresidentkey": {"dfnID":"dom-authenticatorselectioncriteria-requireresidentkey","dfnText":"requireResidentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2463"}],"title":"6.2.2. Credential Storage Modality"}],"url":"#dom-authenticatorselectioncriteria-requireresidentkey"},
-"dom-authenticatorselectioncriteria-residentkey": {"dfnID":"dom-authenticatorselectioncriteria-residentkey","dfnText":"residentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticatorselectioncriteria-residentkey"},
-"dom-authenticatorselectioncriteria-userverification": {"dfnID":"dom-authenticatorselectioncriteria-userverification","dfnText":"userVerification","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2461"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-authenticatorselectioncriteria-userverification"},
+"dom-authenticatorselectioncriteria-residentkey": {"dfnID":"dom-authenticatorselectioncriteria-residentkey","dfnText":"residentKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"},{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-residentkey\u2467"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-authenticatorselectioncriteria-residentkey"},
+"dom-authenticatorselectioncriteria-userverification": {"dfnID":"dom-authenticatorselectioncriteria-userverification","dfnText":"userVerification","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2462"},{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-authenticatorselectioncriteria-userverification\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}],"url":"#dom-authenticatorselectioncriteria-userverification"},
 "dom-authenticatortransport-ble": {"dfnID":"dom-authenticatortransport-ble","dfnText":"ble","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-ble"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}],"url":"#dom-authenticatortransport-ble"},
 "dom-authenticatortransport-hybrid": {"dfnID":"dom-authenticatortransport-hybrid","dfnText":"hybrid","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2461"},{"id":"ref-for-dom-authenticatortransport-hybrid\u2462"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-hybrid\u2463"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#dom-authenticatortransport-hybrid"},
 "dom-authenticatortransport-internal": {"dfnID":"dom-authenticatortransport-internal","dfnText":"internal","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticatortransport-internal"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2461"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-dom-authenticatortransport-internal\u2462"}],"title":"11.2. Virtual Authenticators"}],"url":"#dom-authenticatortransport-internal"},
@@ -11644,13 +11731,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialcreationoptions-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptions-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2461"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestationformats"},
 "dom-publickeycredentialcreationoptions-authenticatorselection": {"dfnID":"dom-publickeycredentialcreationoptions-authenticatorselection","dfnText":"authenticatorSelection","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2467"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2468"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-publickeycredentialcreationoptions-authenticatorselection"},
 "dom-publickeycredentialcreationoptions-challenge": {"dfnID":"dom-publickeycredentialcreationoptions-challenge","dfnText":"challenge","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2462"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-challenge\u2463"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#dom-publickeycredentialcreationoptions-challenge"},
-"dom-publickeycredentialcreationoptions-excludecredentials": {"dfnID":"dom-publickeycredentialcreationoptions-excludecredentials","dfnText":"excludeCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
+"dom-publickeycredentialcreationoptions-excludecredentials": {"dfnID":"dom-publickeycredentialcreationoptions-excludecredentials","dfnText":"excludeCredentials","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2462"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2464"}],"title":"14.5.1. Registration Ceremony Privacy"}],"url":"#dom-publickeycredentialcreationoptions-excludecredentials"},
 "dom-publickeycredentialcreationoptions-extensions": {"dfnID":"dom-publickeycredentialcreationoptions-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-extensions\u2466"}],"title":"9.3. Extending Request Parameters"}],"url":"#dom-publickeycredentialcreationoptions-extensions"},
 "dom-publickeycredentialcreationoptions-hints": {"dfnID":"dom-publickeycredentialcreationoptions-hints","dfnText":"hints","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-hints\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-hints"},
-"dom-publickeycredentialcreationoptions-pubkeycredparams": {"dfnID":"dom-publickeycredentialcreationoptions-pubkeycredparams","dfnText":"pubKeyCredParams","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2461"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2463"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
-"dom-publickeycredentialcreationoptions-rp": {"dfnID":"dom-publickeycredentialcreationoptions-rp","dfnText":"rp","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2466"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2468"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u24ea"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-rp"},
+"dom-publickeycredentialcreationoptions-pubkeycredparams": {"dfnID":"dom-publickeycredentialcreationoptions-pubkeycredparams","dfnText":"pubKeyCredParams","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2463"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2465"}],"title":"7.1. Registering a New Credential"}],"url":"#dom-publickeycredentialcreationoptions-pubkeycredparams"},
+"dom-publickeycredentialcreationoptions-rp": {"dfnID":"dom-publickeycredentialcreationoptions-rp","dfnText":"rp","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2461"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2465"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2466"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u24ea"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-rp\u2460\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}],"url":"#dom-publickeycredentialcreationoptions-rp"},
 "dom-publickeycredentialcreationoptions-timeout": {"dfnID":"dom-publickeycredentialcreationoptions-timeout","dfnText":"timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-timeout\u2463"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#dom-publickeycredentialcreationoptions-timeout"},
-"dom-publickeycredentialcreationoptions-user": {"dfnID":"dom-publickeycredentialcreationoptions-user","dfnText":"user","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2462"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"}],"url":"#dom-publickeycredentialcreationoptions-user"},
+"dom-publickeycredentialcreationoptions-user": {"dfnID":"dom-publickeycredentialcreationoptions-user","dfnText":"user","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2463"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2464"},{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-user\u2467"}],"title":"13.4.6. Credential Loss and Key Mobility"}],"url":"#dom-publickeycredentialcreationoptions-user"},
 "dom-publickeycredentialcreationoptionsjson-attestation": {"dfnID":"dom-publickeycredentialcreationoptionsjson-attestation","dfnText":"attestation","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-attestation"},
 "dom-publickeycredentialcreationoptionsjson-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptionsjson-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-attestationformats"},
 "dom-publickeycredentialcreationoptionsjson-authenticatorselection": {"dfnID":"dom-publickeycredentialcreationoptionsjson-authenticatorselection","dfnText":"authenticatorSelection","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-authenticatorselection"},
@@ -11664,7 +11751,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialcreationoptionsjson-user": {"dfnID":"dom-publickeycredentialcreationoptionsjson-user","dfnText":"user","external":false,"refSections":[],"url":"#dom-publickeycredentialcreationoptionsjson-user"},
 "dom-publickeycredentialdescriptor-id": {"dfnID":"dom-publickeycredentialdescriptor-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2464"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2467"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredentialdescriptor-id"},
 "dom-publickeycredentialdescriptor-transports": {"dfnID":"dom-publickeycredentialdescriptor-transports","dfnText":"transports","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2463"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2464"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2466"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2467"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2468"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}],"url":"#dom-publickeycredentialdescriptor-transports"},
-"dom-publickeycredentialdescriptor-type": {"dfnID":"dom-publickeycredentialdescriptor-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2461"},{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2462"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialdescriptor-type"},
+"dom-publickeycredentialdescriptor-type": {"dfnID":"dom-publickeycredentialdescriptor-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2462"},{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2463"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialdescriptor-type\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"}],"url":"#dom-publickeycredentialdescriptor-type"},
 "dom-publickeycredentialdescriptorjson-id": {"dfnID":"dom-publickeycredentialdescriptorjson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-id"},
 "dom-publickeycredentialdescriptorjson-transports": {"dfnID":"dom-publickeycredentialdescriptorjson-transports","dfnText":"transports","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-transports"},
 "dom-publickeycredentialdescriptorjson-type": {"dfnID":"dom-publickeycredentialdescriptorjson-type","dfnText":"type","external":false,"refSections":[],"url":"#dom-publickeycredentialdescriptorjson-type"},
@@ -11688,10 +11775,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredentialrequestoptionsjson-rpid": {"dfnID":"dom-publickeycredentialrequestoptionsjson-rpid","dfnText":"rpId","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-rpid"},
 "dom-publickeycredentialrequestoptionsjson-timeout": {"dfnID":"dom-publickeycredentialrequestoptionsjson-timeout","dfnText":"timeout","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-timeout"},
 "dom-publickeycredentialrequestoptionsjson-userverification": {"dfnID":"dom-publickeycredentialrequestoptionsjson-userverification","dfnText":"userVerification","external":false,"refSections":[],"url":"#dom-publickeycredentialrequestoptionsjson-userverification"},
-"dom-publickeycredentialrpentity-id": {"dfnID":"dom-publickeycredentialrpentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2465"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2467"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2468"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-publickeycredentialrpentity-id"},
-"dom-publickeycredentialtype-public-key": {"dfnID":"dom-publickeycredentialtype-public-key","dfnText":"public-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2460"},{"id":"ref-for-dom-publickeycredentialtype-public-key\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2462"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2464"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2465"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialtype-public-key"},
+"dom-publickeycredentialrpentity-id": {"dfnID":"dom-publickeycredentialrpentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2465"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2466"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2467"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2468"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2463"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2464"},{"id":"ref-for-dom-publickeycredentialrpentity-id\u2460\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dom-publickeycredentialrpentity-id"},
+"dom-publickeycredentialtype-public-key": {"dfnID":"dom-publickeycredentialtype-public-key","dfnText":"public-key","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2460"},{"id":"ref-for-dom-publickeycredentialtype-public-key\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2463"}],"title":"5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2465"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-dom-publickeycredentialtype-public-key\u2466"}],"title":"11.5. Add Credential"}],"url":"#dom-publickeycredentialtype-public-key"},
 "dom-publickeycredentialuserentity-displayname": {"dfnID":"dom-publickeycredentialuserentity-displayname","dfnText":"displayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2461"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2464"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2465"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2466"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2467"},{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}],"title":"6.4. String Handling"}],"url":"#dom-publickeycredentialuserentity-displayname"},
-"dom-publickeycredentialuserentity-id": {"dfnID":"dom-publickeycredentialuserentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2461"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2465"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2467"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2468"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dom-publickeycredentialuserentity-id"},
+"dom-publickeycredentialuserentity-id": {"dfnID":"dom-publickeycredentialuserentity-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2462"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2463"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2464"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2466"},{"id":"ref-for-dom-publickeycredentialuserentity-id\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-dom-publickeycredentialuserentity-id\u2460\u2460"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dom-publickeycredentialuserentity-id"},
 "dom-publickeycredentialuserentityjson-displayname": {"dfnID":"dom-publickeycredentialuserentityjson-displayname","dfnText":"displayName","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-displayname"},
 "dom-publickeycredentialuserentityjson-id": {"dfnID":"dom-publickeycredentialuserentityjson-id","dfnText":"id","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-id"},
 "dom-publickeycredentialuserentityjson-name": {"dfnID":"dom-publickeycredentialuserentityjson-name","dfnText":"name","external":false,"refSections":[],"url":"#dom-publickeycredentialuserentityjson-name"},
@@ -11703,14 +11790,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-registrationresponsejson-type": {"dfnID":"dom-registrationresponsejson-type","dfnText":"type","external":false,"refSections":[],"url":"#dom-registrationresponsejson-type"},
 "dom-residentkeyrequirement-discouraged": {"dfnID":"dom-residentkeyrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2461"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2462"},{"id":"ref-for-dom-residentkeyrequirement-discouraged\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}],"url":"#dom-residentkeyrequirement-discouraged"},
 "dom-residentkeyrequirement-preferred": {"dfnID":"dom-residentkeyrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2461"},{"id":"ref-for-dom-residentkeyrequirement-preferred\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-preferred\u2463"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-preferred"},
-"dom-residentkeyrequirement-required": {"dfnID":"dom-residentkeyrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required"},{"id":"ref-for-dom-residentkeyrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2461"},{"id":"ref-for-dom-residentkeyrequirement-required\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2464"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-required"},
+"dom-residentkeyrequirement-required": {"dfnID":"dom-residentkeyrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required"},{"id":"ref-for-dom-residentkeyrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2462"},{"id":"ref-for-dom-residentkeyrequirement-required\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2464"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-dom-residentkeyrequirement-required\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#dom-residentkeyrequirement-required"},
 "dom-tokenbinding-id": {"dfnID":"dom-tokenbinding-id","dfnText":"id","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbinding-id"},{"id":"ref-for-dom-tokenbinding-id\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbinding-id"},
 "dom-tokenbinding-status": {"dfnID":"dom-tokenbinding-status","dfnText":"status","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbinding-status"},{"id":"ref-for-dom-tokenbinding-status\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbinding-status"},
 "dom-tokenbindingstatus-present": {"dfnID":"dom-tokenbindingstatus-present","dfnText":"present","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbindingstatus-present"},{"id":"ref-for-dom-tokenbindingstatus-present\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbindingstatus-present"},
 "dom-tokenbindingstatus-supported": {"dfnID":"dom-tokenbindingstatus-supported","dfnText":"supported","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-tokenbindingstatus-supported"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-tokenbindingstatus-supported"},
 "dom-userverificationrequirement-discouraged": {"dfnID":"dom-userverificationrequirement-discouraged","dfnText":"discouraged","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-discouraged\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-discouraged"},
 "dom-userverificationrequirement-preferred": {"dfnID":"dom-userverificationrequirement-preferred","dfnText":"preferred","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-preferred\u2461"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}],"url":"#dom-userverificationrequirement-preferred"},
-"dom-userverificationrequirement-required": {"dfnID":"dom-userverificationrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-required"},{"id":"ref-for-dom-userverificationrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2461"},{"id":"ref-for-dom-userverificationrequirement-required\u2462"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2464"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2465"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-userverificationrequirement-required"},
+"dom-userverificationrequirement-required": {"dfnID":"dom-userverificationrequirement-required","dfnText":"required","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-userverificationrequirement-required"},{"id":"ref-for-dom-userverificationrequirement-required\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2461"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2462"},{"id":"ref-for-dom-userverificationrequirement-required\u2463"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-dom-userverificationrequirement-required\u2466"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-userverificationrequirement-required"},
 "e05ae7c5": {"dfnID":"e05ae7c5","dfnText":"mediation (for CredentialCreationOptions)","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2460"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2461"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2462"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2463"},{"id":"ref-for-dom-credentialcreationoptions-mediation\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-mediation\u2466"}],"title":"7.1. Registering a New Credential"}],"url":"https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation"},
 "e0660c76": {"dfnID":"e0660c76","dfnText":"opaque origin","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-origin-opaque"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-origin-opaque\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque"},
 "e1812e4c": {"dfnID":"e1812e4c","dfnText":"token binding id","external":true,"refSections":[{"refs":[{"id":"ref-for-section-3.2"},{"id":"ref-for-section-3.2\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"https://tools.ietf.org/html/rfc8471#section-3.2"},
@@ -11822,11 +11909,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "ui-redressing": {"dfnID":"ui-redressing","dfnText":"UI Redressing","external":false,"refSections":[{"refs":[{"id":"ref-for-ui-redressing"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-ui-redressing\u2460"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"}],"url":"#ui-redressing"},
 "unsigned-extension-outputs": {"dfnID":"unsigned-extension-outputs","dfnText":"Unsigned extension outputs","external":false,"refSections":[{"refs":[{"id":"ref-for-unsigned-extension-outputs"},{"id":"ref-for-unsigned-extension-outputs\u2460"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2461"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2462"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2463"},{"id":"ref-for-unsigned-extension-outputs\u2464"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-unsigned-extension-outputs\u2465"},{"id":"ref-for-unsigned-extension-outputs\u2466"}],"title":"10.2.1.2. Extension Definition"}],"url":"#unsigned-extension-outputs"},
 "user-account": {"dfnID":"user-account","dfnText":"User Account","external":false,"refSections":[{"refs":[{"id":"ref-for-user-account"},{"id":"ref-for-user-account\u2460"},{"id":"ref-for-user-account\u2461"},{"id":"ref-for-user-account\u2462"},{"id":"ref-for-user-account\u2463"},{"id":"ref-for-user-account\u2464"},{"id":"ref-for-user-account\u2465"},{"id":"ref-for-user-account\u2466"},{"id":"ref-for-user-account\u2467"},{"id":"ref-for-user-account\u2468"},{"id":"ref-for-user-account\u2460\u24ea"},{"id":"ref-for-user-account\u2460\u2460"},{"id":"ref-for-user-account\u2460\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-account\u2460\u2462"},{"id":"ref-for-user-account\u2460\u2463"},{"id":"ref-for-user-account\u2460\u2464"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-user-account\u2460\u2465"},{"id":"ref-for-user-account\u2460\u2466"},{"id":"ref-for-user-account\u2460\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-user-account\u2460\u2468"},{"id":"ref-for-user-account\u2461\u24ea"},{"id":"ref-for-user-account\u2461\u2460"},{"id":"ref-for-user-account\u2461\u2461"},{"id":"ref-for-user-account\u2461\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-account\u2461\u2463"},{"id":"ref-for-user-account\u2461\u2464"},{"id":"ref-for-user-account\u2461\u2465"},{"id":"ref-for-user-account\u2461\u2466"},{"id":"ref-for-user-account\u2461\u2467"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-account\u2461\u2468"},{"id":"ref-for-user-account\u2462\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-user-account\u2462\u2460"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-account\u2462\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-account\u2462\u2462"},{"id":"ref-for-user-account\u2462\u2463"},{"id":"ref-for-user-account\u2462\u2464"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-account\u2462\u2465"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-user-account\u2462\u2466"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-user-account\u2462\u2467"},{"id":"ref-for-user-account\u2462\u2468"},{"id":"ref-for-user-account\u2463\u24ea"},{"id":"ref-for-user-account\u2463\u2460"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-user-account\u2463\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-account\u2463\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-account\u2463\u2463"},{"id":"ref-for-user-account\u2463\u2464"}],"title":"14.6.2. Username Enumeration"}],"url":"#user-account"},
-"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"},{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2462"},{"id":"ref-for-user-consent\u2460\u2463"},{"id":"ref-for-user-consent\u2460\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2465"},{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"},{"id":"ref-for-user-consent\u2460\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u24ea"},{"id":"ref-for-user-consent\u2461\u2460"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2461"},{"id":"ref-for-user-consent\u2461\u2462"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2463"},{"id":"ref-for-user-consent\u2461\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"},{"id":"ref-for-user-consent\u2461\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2461\u2468"},{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
+"user-consent": {"dfnID":"user-consent","dfnText":"User Consent","external":false,"refSections":[{"refs":[{"id":"ref-for-user-consent\u2460"},{"id":"ref-for-user-consent\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-user-consent\u2462"},{"id":"ref-for-user-consent\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-consent\u2464"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-user-consent\u2465"},{"id":"ref-for-user-consent\u2466"},{"id":"ref-for-user-consent\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-consent\u2460\u24ea"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-consent\u2460\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2462"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-user-consent\u2460\u2463"},{"id":"ref-for-user-consent\u2460\u2464"},{"id":"ref-for-user-consent\u2460\u2465"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-user-consent\u2460\u2466"},{"id":"ref-for-user-consent\u2460\u2467"},{"id":"ref-for-user-consent\u2460\u2468"},{"id":"ref-for-user-consent\u2461\u24ea"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2460"},{"id":"ref-for-user-consent\u2461\u2461"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-consent\u2461\u2462"},{"id":"ref-for-user-consent\u2461\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-user-consent\u2461\u2464"},{"id":"ref-for-user-consent\u2461\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-consent\u2461\u2466"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-consent\u2461\u2467"},{"id":"ref-for-user-consent\u2461\u2468"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-user-consent\u2462\u24ea"},{"id":"ref-for-user-consent\u2462\u2460"},{"id":"ref-for-user-consent\u2462\u2461"}],"title":"14.5.2. Authentication Ceremony Privacy"}],"url":"#user-consent"},
 "user-credential": {"dfnID":"user-credential","dfnText":"User Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-user-credential"},{"id":"ref-for-user-credential\u2460"},{"id":"ref-for-user-credential\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-credential\u2462"},{"id":"ref-for-user-credential\u2463"},{"id":"ref-for-user-credential\u2464"},{"id":"ref-for-user-credential\u2465"},{"id":"ref-for-user-credential\u2466"},{"id":"ref-for-user-credential\u2467"},{"id":"ref-for-user-credential\u2468"},{"id":"ref-for-user-credential\u2460\u24ea"},{"id":"ref-for-user-credential\u2460\u2460"}],"title":"10.2.1. Supplemental public keys extension (supplementalPubKeys)"},{"refs":[{"id":"ref-for-user-credential\u2460\u2461"},{"id":"ref-for-user-credential\u2460\u2462"},{"id":"ref-for-user-credential\u2460\u2463"}],"title":"10.2.1.1. Relying Party Usage"},{"refs":[{"id":"ref-for-user-credential\u2460\u2464"},{"id":"ref-for-user-credential\u2460\u2465"},{"id":"ref-for-user-credential\u2460\u2466"}],"title":"10.2.1.2. Extension Definition"},{"refs":[{"id":"ref-for-user-credential\u2460\u2467"}],"title":"10.2.1.2.2. Attestation calculations"},{"refs":[{"id":"ref-for-user-credential\u2460\u2468"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-user-credential\u2461\u24ea"},{"id":"ref-for-user-credential\u2461\u2460"}],"title":"10.2.1.3.2. Authentication (get())"}],"url":"#user-credential"},
 "user-handle": {"dfnID":"user-handle","dfnText":"User Handle","external":false,"refSections":[{"refs":[{"id":"ref-for-user-handle"}],"title":"2.2.1. Backwards Compatibility with FIDO U2F"},{"refs":[{"id":"ref-for-user-handle\u2460"},{"id":"ref-for-user-handle\u2461"},{"id":"ref-for-user-handle\u2462"},{"id":"ref-for-user-handle\u2463"},{"id":"ref-for-user-handle\u2464"},{"id":"ref-for-user-handle\u2465"},{"id":"ref-for-user-handle\u2466"},{"id":"ref-for-user-handle\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-handle\u2468"},{"id":"ref-for-user-handle\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-handle\u2460\u2460"},{"id":"ref-for-user-handle\u2460\u2461"},{"id":"ref-for-user-handle\u2460\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-user-handle\u2460\u2463"},{"id":"ref-for-user-handle\u2460\u2464"},{"id":"ref-for-user-handle\u2460\u2465"},{"id":"ref-for-user-handle\u2460\u2466"},{"id":"ref-for-user-handle\u2460\u2467"},{"id":"ref-for-user-handle\u2460\u2468"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-user-handle\u2461\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-handle\u2461\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-handle\u2461\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2462"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-user-handle\u2461\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-handle\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-handle\u2461\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-user-handle\u2461\u2466"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-handle\u2461\u2467"},{"id":"ref-for-user-handle\u2461\u2468"},{"id":"ref-for-user-handle\u2462\u24ea"},{"id":"ref-for-user-handle\u2462\u2460"}],"title":"14.6.1. User Handle Contents"}],"url":"#user-handle"},
 "user-public-key": {"dfnID":"user-public-key","dfnText":"User Public Key","external":false,"refSections":[{"refs":[{"id":"ref-for-user-public-key"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-public-key\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"#user-public-key"},
-"user-verification": {"dfnID":"user-verification","dfnText":"User Verification","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verification"},{"id":"ref-for-user-verification\u2460"},{"id":"ref-for-user-verification\u2461"},{"id":"ref-for-user-verification\u2462"},{"id":"ref-for-user-verification\u2463"},{"id":"ref-for-user-verification\u2464"},{"id":"ref-for-user-verification\u2465"},{"id":"ref-for-user-verification\u2466"},{"id":"ref-for-user-verification\u2467"},{"id":"ref-for-user-verification\u2468"},{"id":"ref-for-user-verification\u2460\u24ea"},{"id":"ref-for-user-verification\u2460\u2460"},{"id":"ref-for-user-verification\u2460\u2461"},{"id":"ref-for-user-verification\u2460\u2462"},{"id":"ref-for-user-verification\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-verification\u2460\u2464"},{"id":"ref-for-user-verification\u2460\u2465"},{"id":"ref-for-user-verification\u2460\u2466"},{"id":"ref-for-user-verification\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-verification\u2460\u2468"},{"id":"ref-for-user-verification\u2461\u24ea"},{"id":"ref-for-user-verification\u2461\u2460"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-verification\u2461\u2461"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2462"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2463"},{"id":"ref-for-user-verification\u2461\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2465"},{"id":"ref-for-user-verification\u2461\u2466"},{"id":"ref-for-user-verification\u2461\u2467"},{"id":"ref-for-user-verification\u2461\u2468"},{"id":"ref-for-user-verification\u2462\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2462\u2460"},{"id":"ref-for-user-verification\u2462\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-user-verification\u2462\u2462"},{"id":"ref-for-user-verification\u2462\u2463"},{"id":"ref-for-user-verification\u2462\u2464"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-verification\u2462\u2465"},{"id":"ref-for-user-verification\u2462\u2466"},{"id":"ref-for-user-verification\u2462\u2467"},{"id":"ref-for-user-verification\u2462\u2468"},{"id":"ref-for-user-verification\u2463\u24ea"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-user-verification\u2463\u2460"},{"id":"ref-for-user-verification\u2463\u2461"},{"id":"ref-for-user-verification\u2463\u2462"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-verification\u2463\u2465"},{"id":"ref-for-user-verification\u2463\u2466"},{"id":"ref-for-user-verification\u2463\u2467"},{"id":"ref-for-user-verification\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-verification\u2464\u24ea"},{"id":"ref-for-user-verification\u2464\u2460"},{"id":"ref-for-user-verification\u2464\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-user-verification\u2464\u2462"},{"id":"ref-for-user-verification\u2464\u2463"},{"id":"ref-for-user-verification\u2464\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2464\u2465"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-user-verification\u2464\u2466"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-verification\u2464\u2467"},{"id":"ref-for-user-verification\u2464\u2468"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-user-verification\u2465\u24ea"},{"id":"ref-for-user-verification\u2465\u2460"},{"id":"ref-for-user-verification\u2465\u2461"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2465\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-verification\u2465\u2463"}],"title":"15. Accessibility Considerations"}],"url":"#user-verification"},
+"user-verification": {"dfnID":"user-verification","dfnText":"User Verification","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verification"},{"id":"ref-for-user-verification\u2460"},{"id":"ref-for-user-verification\u2461"},{"id":"ref-for-user-verification\u2462"},{"id":"ref-for-user-verification\u2463"},{"id":"ref-for-user-verification\u2464"},{"id":"ref-for-user-verification\u2465"},{"id":"ref-for-user-verification\u2466"},{"id":"ref-for-user-verification\u2467"},{"id":"ref-for-user-verification\u2468"},{"id":"ref-for-user-verification\u2460\u24ea"},{"id":"ref-for-user-verification\u2460\u2460"},{"id":"ref-for-user-verification\u2460\u2461"},{"id":"ref-for-user-verification\u2460\u2462"},{"id":"ref-for-user-verification\u2460\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-user-verification\u2460\u2464"},{"id":"ref-for-user-verification\u2460\u2465"},{"id":"ref-for-user-verification\u2460\u2466"},{"id":"ref-for-user-verification\u2460\u2467"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-user-verification\u2460\u2468"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-user-verification\u2461\u24ea"},{"id":"ref-for-user-verification\u2461\u2460"},{"id":"ref-for-user-verification\u2461\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-user-verification\u2461\u2462"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2463"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2464"},{"id":"ref-for-user-verification\u2461\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-user-verification\u2461\u2466"},{"id":"ref-for-user-verification\u2461\u2467"},{"id":"ref-for-user-verification\u2461\u2468"},{"id":"ref-for-user-verification\u2462\u24ea"},{"id":"ref-for-user-verification\u2462\u2460"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-user-verification\u2462\u2461"},{"id":"ref-for-user-verification\u2462\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-user-verification\u2462\u2463"},{"id":"ref-for-user-verification\u2462\u2464"},{"id":"ref-for-user-verification\u2462\u2465"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-user-verification\u2462\u2466"},{"id":"ref-for-user-verification\u2462\u2467"},{"id":"ref-for-user-verification\u2462\u2468"},{"id":"ref-for-user-verification\u2463\u24ea"},{"id":"ref-for-user-verification\u2463\u2460"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-user-verification\u2463\u2461"},{"id":"ref-for-user-verification\u2463\u2462"},{"id":"ref-for-user-verification\u2463\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2464"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-user-verification\u2463\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-user-verification\u2463\u2466"},{"id":"ref-for-user-verification\u2463\u2467"},{"id":"ref-for-user-verification\u2463\u2468"},{"id":"ref-for-user-verification\u2464\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-user-verification\u2464\u2460"},{"id":"ref-for-user-verification\u2464\u2461"},{"id":"ref-for-user-verification\u2464\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-user-verification\u2464\u2463"},{"id":"ref-for-user-verification\u2464\u2464"},{"id":"ref-for-user-verification\u2464\u2465"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2464\u2466"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-user-verification\u2464\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-user-verification\u2464\u2468"},{"id":"ref-for-user-verification\u2465\u24ea"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-user-verification\u2465\u2460"},{"id":"ref-for-user-verification\u2465\u2461"},{"id":"ref-for-user-verification\u2465\u2462"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"},{"refs":[{"id":"ref-for-user-verification\u2465\u2463"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-user-verification\u2465\u2464"}],"title":"15. Accessibility Considerations"}],"url":"#user-verification"},
 "user-verifying-platform-authenticator": {"dfnID":"user-verifying-platform-authenticator","dfnText":"User-verifying platform authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-user-verifying-platform-authenticator"},{"id":"ref-for-user-verifying-platform-authenticator\u2460"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2461"},{"id":"ref-for-user-verifying-platform-authenticator\u2462"},{"id":"ref-for-user-verifying-platform-authenticator\u2463"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-user-verifying-platform-authenticator\u2465"}],"title":"6.2. Authenticator Taxonomy"}],"url":"#user-verifying-platform-authenticator"},
 "verification-procedure": {"dfnID":"verification-procedure","dfnText":"Verification procedure","external":false,"refSections":[{"refs":[{"id":"ref-for-verification-procedure"},{"id":"ref-for-verification-procedure\u2460"},{"id":"ref-for-verification-procedure\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-verification-procedure\u2462"},{"id":"ref-for-verification-procedure\u2463"},{"id":"ref-for-verification-procedure\u2464"},{"id":"ref-for-verification-procedure\u2465"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-verification-procedure\u2466"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2467"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2468"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u24ea"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2460"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2461"},{"id":"ref-for-verification-procedure\u2460\u2462"},{"id":"ref-for-verification-procedure\u2460\u2463"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2464"}],"title":"10.2.1.3.1. Registration (create())"},{"refs":[{"id":"ref-for-verification-procedure\u2460\u2465"},{"id":"ref-for-verification-procedure\u2460\u2466"}],"title":"10.2.1.3.2. Authentication (get())"}],"url":"#verification-procedure"},
 "verification-procedure-inputs": {"dfnID":"verification-procedure-inputs","dfnText":"verification procedure inputs","external":false,"refSections":[{"refs":[{"id":"ref-for-verification-procedure-inputs"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2460"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2461"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2462"}],"title":"8.5. Android SafetyNet Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2463"}],"title":"8.6. FIDO U2F Attestation Statement Format"},{"refs":[{"id":"ref-for-verification-procedure-inputs\u2464"},{"id":"ref-for-verification-procedure-inputs\u2465"}],"title":"8.9. Compound Attestation Statement Format"}],"url":"#verification-procedure-inputs"},
@@ -11837,9 +11924,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "webauthn-authenticator": {"dfnID":"webauthn-authenticator","dfnText":"WebAuthn Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-authenticator"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461"},{"id":"ref-for-webauthn-authenticator\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2463"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2465"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2466"},{"id":"ref-for-webauthn-authenticator\u2467"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2460"},{"id":"ref-for-webauthn-authenticator\u2460\u2461"}],"title":"13.3.1. Attestation Certificate Hierarchy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2462"},{"id":"ref-for-webauthn-authenticator\u2460\u2463"},{"id":"ref-for-webauthn-authenticator\u2460\u2464"},{"id":"ref-for-webauthn-authenticator\u2460\u2465"},{"id":"ref-for-webauthn-authenticator\u2460\u2466"},{"id":"ref-for-webauthn-authenticator\u2460\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2468"},{"id":"ref-for-webauthn-authenticator\u2461\u24ea"}],"title":"14.4.1. Attestation Privacy"}],"url":"#webauthn-authenticator"},
 "webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2466"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2467"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2468"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
 "webauthn-client-device": {"dfnID":"webauthn-client-device","dfnText":"WebAuthn Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client-device"},{"id":"ref-for-webauthn-client-device\u2460"}],"title":"4. Terminology"}],"url":"#webauthn-client-device"},
-"webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"},{"id":"ref-for-webauthn-extensions\u2468"},{"id":"ref-for-webauthn-extensions\u2460\u24ea"}],"title":"9. WebAuthn Extensions"}],"url":"#webauthn-extensions"},
+"webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2468"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u24ea"},{"id":"ref-for-webauthn-extensions\u2460\u2460"},{"id":"ref-for-webauthn-extensions\u2460\u2461"}],"title":"9. WebAuthn Extensions"}],"url":"#webauthn-extensions"},
 "webauthn-fido2-protocol": {"dfnID":"webauthn-fido2-protocol","dfnText":"WebAuthn/FIDO2 protocol","external":false,"refSections":[],"url":"#webauthn-fido2-protocol"},
-"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2463"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2467"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u24ea"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2460"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2461"},{"id":"ref-for-webauthn-relying-party\u2462\u2462"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"},{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"14.6.2. Username Enumeration"}],"url":"#webauthn-relying-party"},
+"webauthn-relying-party": {"dfnID":"webauthn-relying-party","dfnText":"WebAuthn Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-relying-party\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464"}],"title":"2.3. WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465"},{"id":"ref-for-webauthn-relying-party\u2466"},{"id":"ref-for-webauthn-relying-party\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u24ea"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2461"},{"id":"ref-for-webauthn-relying-party\u2460\u2462"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2464"},{"id":"ref-for-webauthn-relying-party\u2460\u2465"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2467"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2460\u2468"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u24ea"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2460"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2461"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2466"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2467"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2461\u2468"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u24ea"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2460"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2461"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2463"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2464"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2465"},{"id":"ref-for-webauthn-relying-party\u2462\u2466"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2467"}],"title":"8.4. Android Key Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2462\u2468"}],"title":"8.7. None Attestation Statement Format"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u24ea"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2460"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2461"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2462"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2463"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2465"}],"title":"12.2. WebAuthn Attestation Statement Format Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2466"}],"title":"12.3. WebAuthn Extension Identifier Registrations Updates"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2463\u2467"},{"id":"ref-for-webauthn-relying-party\u2463\u2468"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2460"}],"title":"13.1. Credential ID Unsigned"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2461"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2462"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2463"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2465"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2467"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2464\u2468"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u24ea"}],"title":"14.5.4. Disclosing Client Capabilities"},{"refs":[{"id":"ref-for-webauthn-relying-party\u2465\u2460"}],"title":"14.6.2. Username Enumeration"}],"url":"#webauthn-relying-party"},
 "webauthn-signature": {"dfnID":"webauthn-signature","dfnText":"WebAuthn signature","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-signature"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-webauthn-signature\u2460"}],"title":"6. WebAuthn Authenticator Model"}],"url":"#webauthn-signature"},
 };
 
@@ -12722,7 +12809,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"\u00a76. authenticator api","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticator-api"},
 "https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"large, per-credential blobs","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#authenticatorLargeBlobs"},
 "https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form": {"export":true,"for_":[],"level":"","normative":true,"shortname":"fido-ctap","spec":"fido-ctap","status":"anchor-block","text":"ctap2 canonical cbor encoding form","type":"dfn","url":"https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#ctap2-canonical-cbor-encoding-form"},
-"https://heycam.github.io/webidl#dfn-get-buffer-source-copy": {"export":true,"for_":[],"level":"","normative":true,"shortname":"webidl","spec":"webidl","status":"anchor-block","text":"get a copy of the bytes held by the buffer source","type":"dfn","url":"https://heycam.github.io/webidl#dfn-get-buffer-source-copy"},
 "https://html.spec.whatwg.org/#focus": {"export":true,"for_":[],"level":"","normative":true,"shortname":"whatwg html","spec":"whatwg html","status":"anchor-block","text":"focus","type":"dfn","url":"https://html.spec.whatwg.org/#focus"},
 "https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"html","spec":"html","status":"current","text":"ascii serialization of an origin","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin"},
 "https://html.spec.whatwg.org/multipage/browsers.html#browsing-context": {"export":true,"for_":[],"level":"","normative":true,"shortname":"html","spec":"html","status":"anchor-block","text":"browsing context","type":"dfn","url":"https://html.spec.whatwg.org/multipage/browsers.html#browsing-context"},
@@ -12867,11 +12953,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "https://webidl.spec.whatwg.org/#Exposed": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"Exposed","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#Exposed"},
 "https://webidl.spec.whatwg.org/#SameObject": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SameObject","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SameObject"},
 "https://webidl.spec.whatwg.org/#SecureContext": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"SecureContext","type":"extended-attribute","url":"https://webidl.spec.whatwg.org/#SecureContext"},
+"https://webidl.spec.whatwg.org/#aborterror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"AbortError","type":"exception","url":"https://webidl.spec.whatwg.org/#aborterror"},
 "https://webidl.spec.whatwg.org/#constrainterror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ConstraintError","type":"exception","url":"https://webidl.spec.whatwg.org/#constrainterror"},
 "https://webidl.spec.whatwg.org/#dfn-buffer-source-type": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"buffer source types","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-buffer-source-type"},
 "https://webidl.spec.whatwg.org/#dfn-enumeration-value": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"enumeration value","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-enumeration-value"},
+"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"get a copy of the bytes held by the buffer source","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy"},
 "https://webidl.spec.whatwg.org/#dfn-interface-object": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"interface object","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-interface-object"},
 "https://webidl.spec.whatwg.org/#dfn-json-types": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"json type","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-json-types"},
+"https://webidl.spec.whatwg.org/#dfn-simple-exception": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"simple exception","type":"dfn","url":"https://webidl.spec.whatwg.org/#dfn-simple-exception"},
 "https://webidl.spec.whatwg.org/#encodingerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"EncodingError","type":"exception","url":"https://webidl.spec.whatwg.org/#encodingerror"},
 "https://webidl.spec.whatwg.org/#exceptiondef-typeerror": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"TypeError","type":"exception","url":"https://webidl.spec.whatwg.org/#exceptiondef-typeerror"},
 "https://webidl.spec.whatwg.org/#idl-ArrayBuffer": {"export":true,"for_":[],"level":"1","normative":true,"shortname":"webidl","spec":"webidl","status":"current","text":"ArrayBuffer","type":"interface","url":"https://webidl.spec.whatwg.org/#idl-ArrayBuffer"},