diff --git a/index.html b/index.html
index 6b7a73ebe..93eca4aee 100644
--- a/index.html
+++ b/index.html
@@ -2,11 +2,11 @@
  <head>
   <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
-  <title>Web Authentication: An API for accessing Public Key Credentials - Level</title>
+  <title>Web Authentication: An API for accessing Public Key Credentials - Level 3</title>
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="40be3dbfbfefc151a6ffb59d8ef902a324028585" name="document-revision">
+  <meta content="84feb409dc9bb19675dffd93ecba411682bed31e" name="document-revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -914,7 +914,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-09-11">11 September 2023</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-11-29">29 November 2023</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -931,7 +931,7 @@ <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level
       <dt>Feedback:
       <dd><a href="https://github.com/w3c/webauthn/issues">GitHub</a>
       <dt class="editor">Editors:
-      <dd class="editor p-author h-card vcard" data-editor-id="38745"><a class="p-name fn u-email email" href="mailto:michael_b_jones@hotmail.com">Michael B. Jones</a> (<span class="p-org org">independent</span>)
+      <dd class="editor p-author h-card vcard" data-editor-id="38745"><a class="p-name fn u-email email" href="mailto:michael_b_jones@hotmail.com">Michael B. Jones</a> (<span class="p-org org">Self-Issued Consulting</span>)
       <dd class="editor p-author h-card vcard" data-editor-id="99318"><a class="p-name fn u-email email" href="mailto:akshayku@microsoft.com">Akshay Kumar</a> (<span class="p-org org">Microsoft</span>)
       <dd class="editor p-author h-card vcard" data-editor-id="102508"><a class="p-name fn u-email email" href="mailto:emil@yubico.com">Emil Lundberg</a> (<span class="p-org org">Yubico</span>)
       <dt class="editor">Former Editors:
@@ -952,6 +952,7 @@ <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level
       <dd><a href="mailto:mandyam@qti.qualcomm.com">Giridhar Mandyam</a> (Qualcomm)
       <dd><a href="mailto:mattmil3@cisco.com">Matthew Miller</a> (Cisco)
       <dd><a href="mailto:nsatragno@google.com">Nina Satragno</a> (Google)
+      <dd><a href="mailto:kieun.shin@sk.com">Ki-Eun Shin</a> (SK Telecom)
       <dd><a href="mailto:nick.steele@agilebits.com">Nick Steele</a> (1Password)
       <dd><a href="mailto:jiewen_tan@apple.com">Jiewen Tan</a> (Apple)
       <dd><a href="mailto:sweeden@au1.ibm.com">Shane Weeden</a> (IBM)
@@ -963,7 +964,7 @@ <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level
     </div>
    </details>
    <div data-fill-with="warning"></div>
-   <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/Consortium/Legal/ipr-notice#Copyright">Copyright</a> © 2023 <a href="https://www.w3.org/">World Wide Web Consortium</a>. <abbr title="World Wide Web Consortium">W3C</abbr><sup>®</sup> <a href="https://www.w3.org/Consortium/Legal/ipr-notice#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/Consortium/Legal/ipr-notice#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/Consortium/Legal/copyright-software" rel="license" title="W3C Software and Document License">permissive document license</a> rules apply. </p>
+   <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/policies/#copyright">Copyright</a> © 2023 <a href="https://www.w3.org/">World Wide Web Consortium</a>. <abbr title="World Wide Web Consortium">W3C</abbr><sup>®</sup> <a href="https://www.w3.org/policies/#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/policies/#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/copyright/software-license/" rel="license" title="W3C Software and Document License">permissive document license</a> rules apply. </p>
    <hr title="Separator for header">
   </div>
   <div class="p-summary" data-fill-with="abstract">
@@ -994,7 +995,7 @@ <h2 class="no-num no-toc no-ref heading settled" id="sotd"><span class="content"
     includes instructions for disclosing a patent. An individual who has actual knowledge of a
     patent which the individual believes contains <a href="https://www.w3.org/Consortium/Patent-Policy/#def-essential">Essential
     Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/Consortium/Patent-Policy/#sec-Disclosure">section 6 of the <abbr title="World Wide Web Consortium">W3C</abbr> Patent Policy</a>. </p>
-   <p> This document is governed by the <a href="https://www.w3.org/2023/Process-20230612/" id="w3c_process_revision">12 June 2023 W3C Process Document</a>. </p>
+   <p> This document is governed by the <a href="https://www.w3.org/2023/Process-20231103/" id="w3c_process_revision">03 November 2023 W3C Process Document</a>. </p>
    <p></p>
   </div>
   <div data-fill-with="at-risk"></div>
@@ -1192,6 +1193,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li><a href="#sctn-fido-u2f-attestation"><span class="secno">8.6</span> <span class="content">FIDO U2F Attestation Statement Format</span></a>
       <li><a href="#sctn-none-attestation"><span class="secno">8.7</span> <span class="content">None Attestation Statement Format</span></a>
       <li><a href="#sctn-apple-anonymous-attestation"><span class="secno">8.8</span> <span class="content">Apple Anonymous Attestation Statement Format</span></a>
+      <li><a href="#sctn-compound-attestation"><span class="secno">8.9</span> <span class="content">Compound Attestation Statement Format</span></a>
      </ol>
     <li>
      <a href="#sctn-extensions"><span class="secno">9</span> <span class="content"><span>WebAuthn Extensions</span></span></a>
@@ -1219,20 +1221,20 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
        <ol class="toc">
         <li><a href="#sctn-uvm-extension"><span class="secno">10.2.1</span> <span class="content"><span>User Verification Method</span> Extension (uvm)</span></a>
         <li>
-         <a href="#sctn-device-publickey-extension"><span class="secno">10.2.2</span> <span class="content">Device-bound public key extension (<span>devicePubKey</span>)</span></a>
+         <a href="#sctn-supplemental-public-keys-extension"><span class="secno">10.2.2</span> <span class="content">Supplemental public keys extension (<span>supplementalPubKeys</span>)</span></a>
          <ol class="toc">
-          <li><a href="#sctn-device-publickey-extension-usage"><span class="secno">10.2.2.1</span> <span class="content">Relying Party Usage</span></a>
+          <li><a href="#sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.2.1</span> <span class="content">Relying Party Usage</span></a>
           <li>
-           <a href="#sctn-device-publickey-extension-definition"><span class="secno">10.2.2.2</span> <span class="content">Extension Definition</span></a>
+           <a href="#sctn-supplemental-public-keys-extension-definition"><span class="secno">10.2.2.2</span> <span class="content">Extension Definition</span></a>
            <ol class="toc">
-            <li><a href="#sctn-device-publickey-attestation-aaguid"><span class="secno">10.2.2.2.1</span> <span class="content">AAGUIDs</span></a>
-            <li><a href="#sctn-device-publickey-attestation-calculations"><span class="secno">10.2.2.2.2</span> <span class="content">Attestation calculations</span></a>
+            <li><a href="#sctn-supplemental-public-keys-attestation-aaguid"><span class="secno">10.2.2.2.1</span> <span class="content">AAGUIDs</span></a>
+            <li><a href="#sctn-supplemental-public-keys-attestation-calculations"><span class="secno">10.2.2.2.2</span> <span class="content">Attestation calculations</span></a>
            </ol>
           <li>
-           <a href="#sctn-device-publickey-extension-verification"><span class="secno">10.2.2.3</span> <span class="content"><code>devicePubKey</code> Extension Output Verification Procedures</span></a>
+           <a href="#sctn-supplemental-public-keys-extension-verification"><span class="secno">10.2.2.3</span> <span class="content"><code>supplementalPubKeys</code> Extension Output Verification Procedures</span></a>
            <ol class="toc">
-            <li><a href="#sctn-device-publickey-extension-verification-create"><span class="secno">10.2.2.3.1</span> <span class="content">Registration (<code>create()</code>)</span></a>
-            <li><a href="#sctn-device-publickey-extension-verification-get"><span class="secno">10.2.2.3.2</span> <span class="content">Authentication (<code>get()</code>)</span></a>
+            <li><a href="#sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.2.3.1</span> <span class="content">Registration (<code>create()</code>)</span></a>
+            <li><a href="#sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.2.3.2</span> <span class="content">Authentication (<code>get()</code>)</span></a>
            </ol>
          </ol>
        </ol>
@@ -1314,7 +1316,11 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-credential-id-privacy-leak"><span class="secno">14.6.3</span> <span class="content">Privacy leak via credential IDs</span></a>
        </ol>
      </ol>
-    <li><a href="#sctn-accessiblility-considerations"><span class="secno">15</span> <span class="content">Accessibility Considerations</span></a>
+    <li>
+     <a href="#sctn-accessiblility-considerations"><span class="secno">15</span> <span class="content">Accessibility Considerations</span></a>
+     <ol class="toc">
+      <li><a href="#sctn-timeout-recommended-range"><span class="secno">15.1</span> <span class="content">Recommended Range for Ceremony Timeouts</span></a>
+     </ol>
     <li><a href="#sctn-acknowledgements"><span class="secno">16</span> <span class="content">Acknowledgements</span></a>
     <li>
      <a href="#index"><span class="secno"></span> <span class="content">Index</span></a>
@@ -1882,7 +1888,7 @@ <h2 class="heading settled" data-level="3" id="sctn-dependencies"><span class="s
     <dt data-md>CBOR
     <dd data-md>
      <p>A number of structures in this specification, including attestation statements and extensions, are encoded using the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form②">CTAP2 canonical CBOR encoding form</a> of the Compact Binary Object Representation (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cbor">CBOR</dfn>) <a data-link-type="biblio" href="#biblio-rfc8949" title="Concise Binary Object Representation (CBOR)">[RFC8949]</a>,
-as defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
+as defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
     <dt data-md>CDDL
     <dd data-md>
      <p>This specification describes the syntax of all <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①">CBOR</a>-encoded data using the CBOR Data Definition Language (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cddl">CDDL</dfn>) <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a>.</p>
@@ -1923,7 +1929,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dd data-md>
      <p>Generally, <em>attestation</em> is a statement that serves to bear witness, confirm, or authenticate.
 In the WebAuthn context, <a data-link-type="dfn" href="#attestation" id="ref-for-attestation③">attestation</a> is employed to provide verifiable evidence as to the origin of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③">authenticator</a> and the data it emits. This includes such things as <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④">credential IDs</a>, <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair">credential key pairs</a>, <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter">signature counters</a>, etc.</p>
-     <p>An <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement">attestation statement</a> is provided within an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object">attestation object</a> during a <a data-link-type="dfn" href="#registration" id="ref-for-registration③">registration</a> ceremony. See also <a href="#sctn-attestation">§ 6.5 Attestation</a> and <a href="#fig-attStructs">Figure 6</a>. Whether or how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥">client</a> conveys the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①">attestation statement</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid">AAGUID</a> portions of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①">attestation object</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③">Relying Party</a> is described by <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance">attestation conveyance</a>.</p>
+     <p>An <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement">attestation statement</a> is provided within an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object">attestation object</a> during a <a data-link-type="dfn" href="#registration" id="ref-for-registration③">registration</a> ceremony. See also <a href="#sctn-attestation">§ 6.5 Attestation</a> and <a href="#fig-attStructs">Figure 6</a>. Whether or how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥">client</a> conveys the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①">attestation statement</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid">aaguid</a> portions of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①">attestation object</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③">Relying Party</a> is described by <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance">attestation conveyance</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-certificate">Attestation Certificate</dfn>
     <dd data-md>
      <p>An X.509 Certificate for the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-key-pair">attestation key pair</dfn> used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④">authenticator</a> to attest to its manufacture
@@ -1952,7 +1958,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
      <p>A cryptographic entity, existing in hardware or software, that can <a data-link-type="dfn" href="#registration" id="ref-for-registration⑥">register</a> a user with a given <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧">Relying Party</a> and later <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①">assert possession</a> of the registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⓪">public key credential</a>, and optionally <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①">verify the user</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨">Relying Party</a>. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨">Authenticators</a> can report information
 regarding their <a data-link-type="dfn" href="#authenticator-type" id="ref-for-authenticator-type">type</a> and security characteristics via <a data-link-type="dfn" href="#attestation" id="ref-for-attestation④">attestation</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration⑦">registration</a> and <a data-link-type="dfn" href="#assertion" id="ref-for-assertion">assertion</a>.</p>
      <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator②">WebAuthn Authenticator</a> could be a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑤">roaming authenticator</a>, a dedicated hardware subsystem integrated into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④">client device</a>,
-or a software component of the <a data-link-type="dfn" href="#client" id="ref-for-client⑦">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device⑤">client device</a>. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator③">WebAuthn Authenticator</a> is not necessarily confined to operating in 
+or a software component of the <a data-link-type="dfn" href="#client" id="ref-for-client⑦">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device⑤">client device</a>. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator③">WebAuthn Authenticator</a> is not necessarily confined to operating in
 a local context, and can generate or store a <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair①">credential key pair</a> in a server outside of <a data-link-type="dfn" href="#client-side" id="ref-for-client-side">client-side</a> hardware.</p>
      <p>In general, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪">authenticator</a> is assumed to have only one user.
 If multiple natural persons share access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①">authenticator</a>,
@@ -2144,45 +2150,48 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The value of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson">clientDataJSON</a></code> attribute
 when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②④">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①②">registered</a>.
 Storing this in combination with the above <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject">attestationObject</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item②">item</a> enables the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤③">Relying Party</a> to re-verify the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①">attestation signature</a> at a later time.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</dfn>
+      <dd data-md>
+       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> description of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>.</p>
+       <p>If used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Party</a> SHOULD use this to describe the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a> in the user’s account settings.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> SHOULD allow the user to choose this value, and MAY allow the user to modify it at will.</p>
+       <p>The <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> defines the <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential property</a> <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname">authenticatorDisplayName</a></code> which, when available, MAY be offered as a default for this value.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a> MAY also derive a default value from the authenticator’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a>, if any.</p>
      </dl>
-     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
+     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
 and MAY omit any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑤">items</a> not needed for their implementation.</p>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-descriptor-for-a-credential-record">credential descriptor for a credential record</dfn> is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a></code> value with the contents:</p>
      <dl>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type">type</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id">id</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
       <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①">transports</a></code>
       <dd data-md>
-       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
+       <p>The <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a>.</p>
      </dl>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="hardware-bound-device-key-pair">Hardware-bound Device Key Pair</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="device-bound-key">Device-bound Key</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="device-private-key">Device Private Key</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="device-public-key">Device Public Key</dfn>
-    <dd data-md>
-     <p>A <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair">hardware-bound device key pair</a>, also known as a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key">device-bound key</a>, is an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a>-, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a>-, and <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential">user credential</a>-specific public key pair created upon a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a>'s request via the <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey">devicePubKey</a> <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn extension</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> that a <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair①">hardware-bound device key pair</a> is created upon guarantees that the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key">device private key</a> is securely stored in hardware, i.e., it is unextractable. See also <a href="#sctn-device-publickey-extension">§ 10.2.2 Device-bound public key extension (devicePubKey)</a>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> All guarantees about the operation of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> operation rely on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attestation</a>. In particular, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Parties</a> MUST NOT rely on the above guarantee of unextractability unless supported by a valid, trusted <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplemental-public-key">Supplemental public key</dfn>
+    <dd data-md>
+     <p>A additional public key, associated with a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential">user credential</a>, that can be obtained (and exercised) with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys">supplementalPubKeys</a> extension. These public keys provide more specific continuity signals. For example, a supplemental public key with <code>device</code> scope never leaves the device, while a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credential</a> can. Other supplemental public keys might have a broader scope, as described by their <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attestation</a>.</p>
+     <p>Supplemental public keys MUST NOT have a scope that exceeds the scope of their <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>—i.e. they never link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credentials</a> together. While this specification defines norms around scopes, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Parties</a> have to evaluate supplemental public keys in light of their <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a>, if any, and assign credibility to claimed scopes accordingly.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="generating-authenticator">Generating Authenticator</dfn>
     <dd data-md>
      <p>The Generating Authenticator is the authenticator involved in the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①">authenticatorMakeCredential</a> operation resulting
-in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the
+in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credentials</a>, the generating authenticator may or may not be the same as the
 current <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑧">managing authenticator</a> participating in a given <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑤">authentication</a> operation.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="human-palatability">Human Palatability</dfn>
     <dd data-md>
-     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability">human-palatable</a> is intended to be rememberable and reproducible by typical human
+     <p>An identifier that is <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> is intended to be rememberable and reproducible by typical human
 users, in contrast to identifiers that are, for example, randomly generated sequences of bits <a data-link-type="biblio" href="#biblio-edupersonobjectclassspec" title="EduPerson">[EduPersonObjectClassSpec]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-discoverable-credential">Non-Discoverable Credential</dfn>
     <dd data-md>
      <p>This is a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③">credential</a> whose <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①①">credential ID</a> must be provided in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②">allowCredentials</a></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④">navigator.credentials.get()</a></code> because it is not <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential④">client-side discoverable</a>. See also <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential②">server-side credentials</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential">Public Key Credential</dfn>
     <dd data-md>
-     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>, the
-possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
+     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>, the
+possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
      <div class="note" role="note">
        Note: This is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#willful-violation" id="ref-for-willful-violation">willful violation</a> of <a data-link-type="biblio" href="#biblio-rfc4949" title="Internet Security Glossary, Version 2">[RFC4949]</a>. In English, a "credential" is both a) the thing presented to prove
     a statement and b) intended to be used multiple times. It’s impossible to achieve both criteria securely with a single
@@ -2192,7 +2201,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
       <dl>
        <dt data-md>"Authentication information" (possibly including a private key)
        <dd data-md>
-        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">Public key credential source</a></p>
+        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">Public key credential source</a></p>
        <dt data-md>"Signed value"
        <dd data-md>
         <p><a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion④">Authentication assertion</a></p>
@@ -2201,12 +2210,12 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
         <p><a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑧">Credential public key</a> or <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②">attestation object</a></p>
       </dl>
      </div>
-     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
-Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a> uses its stored
+     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
+Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> uses its stored
 copy of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⓪">credential public key</a> to verify the resultant <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑤">authentication assertion</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential-source">Public Key Credential Source</dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤③">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
+     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-type">type</dfn>
       <dd data-md>
@@ -2219,20 +2228,20 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <p>The <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key④">credential private key</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-rpid">rpId</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
+       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
 This is determined by the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id">id</a></code></code> parameter of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①">create()</a></code> operation.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-userhandle">userHandle</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
+       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
 nullable, however <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②">user handle</a> MUST always be populated for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②">discoverable credentials</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-otherui">otherUI</dfn>
       <dd data-md>
-       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
+       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
      </dl>
-     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
+     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
 credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-managing-authenticator">managing authenticator</dfn> and returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①①">credential public key</a> associated with its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑤">credential
-private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
-this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a>.</p>
+private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
+this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rate-limiting">Rate Limiting</dfn>
     <dd data-md>
      <p>The process (also known as throttling) by which an authenticator implements controls against brute force attacks by limiting
@@ -2243,25 +2252,25 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration">Registration</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration-ceremony">Registration Ceremony</dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
+     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤②">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
 Note that this includes employing a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence②">test of user presence</a> or <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑦">user verification</a>.
 After a successful <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②">registration ceremony</a>, the user can be authenticated by an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥">authentication ceremony</a>.</p>
      <p>The WebAuthn <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③">registration ceremony</a> is defined in <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
+and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
 with a <code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey">publicKey</a></code> argument.
 See <a href="#sctn-api">§ 5 Web Authentication API</a> for an introductory overview and <a href="#sctn-sample-registration">§ 1.3.1 Registration</a> for implementation examples.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party">Relying Party</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-relying-party">WebAuthn Relying Party</dfn>
     <dd data-md>
      <p>The entity whose <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-application">web application</dfn> utilizes the <a href="#sctn-api">Web Authentication API</a> to <a data-link-type="dfn" href="#registration" id="ref-for-registration①④">register</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑦">authenticate</a> users.</p>
-     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> implementation typically consists of both some client-side script
+     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> implementation typically consists of both some client-side script
 that invokes the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑦">Web Authentication API</a> in the <a data-link-type="dfn" href="#client" id="ref-for-client①④">client</a>,
 and a server-side component that executes the <a href="#sctn-rp-operations">Relying Party operations</a> and other application logic.
 Communication between the two components MUST use HTTPS or equivalent transport security,
 but is otherwise beyond the scope of this specification.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> in one
-    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
-    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
+     <p class="note" role="note"><span class="marker">Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> in one
+    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
+    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
     a WebAuthn context may be embedded in a broader overall context, e.g., one based on OAuth.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party-identifier">Relying Party Identifier</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rp-id">RP ID</dfn>
@@ -2281,7 +2290,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <li data-md>
         <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised③">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port②">port</a> is unrestricted.</p>
       </ul>
-      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>.</p>
+      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>.</p>
       <p>This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, <a data-link-type="biblio" href="#biblio-rfc6265" title="HTTP State Management Mechanism">[RFC6265]</a>).
     Please note that this is a greater relaxation of "same-origin" restrictions than what <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain" id="ref-for-dom-document-domain">document.domain</a>'s setter provides.</p>
       <p>These restrictions on origin values apply to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑤">WebAuthn Clients</a>.</p>
@@ -2295,10 +2304,10 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 For backwards compatibility purposes, the various <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⓪">WebAuthn API</a> and <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model①">Authenticator Model</a> components
 with various forms of <code>resident</code> within their names have not been changed.</p>
      <p>A <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source①">Server-side Public Key Credential Source</a>, or <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential④">Server-side Credential</a> for short,
-is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> must
+is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a> must
 manage the credential’s storage and discovery, as well as be able to first identify the user in order to
 discover the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①④">credential IDs</a> to supply in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑦">navigator.credentials.get()</a></code> call.</p>
-     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
+     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side②">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
 This is in contrast to a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑤">client-side discoverable credential</a>,
 which instead does not require the user to first be identified in order to provide the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑤">credential ID</a>s
 to a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑧">navigator.credentials.get()</a></code> call.</p>
@@ -2306,35 +2315,35 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="test-of-user-presence">Test of User Presence</dfn>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence③">test of user presence</a> is a simple form of <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⓪">authorization gesture</a> and technical process where a user interacts with
-an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑥">authenticator</a> by (typically) simply touching it (other modalities may also exist), yielding a Boolean result. Note
+an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤③">authenticator</a> by (typically) simply touching it (other modalities may also exist), yielding a Boolean result. Note
 that this does not constitute <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑧">user verification</a> because a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence④">user presence test</a>, by definition,
 is not capable of <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition①">biometric recognition</a>, nor does it involve the presentation of a shared secret such as a password or
 PIN.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-account">User Account</dfn>
     <dd data-md>
      <p>In the context of this specification,
-a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
+a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
 This mapping, the set of credentials, and their authorizations, may evolve over time.
 A given <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑦">user account</a> might be accessed by one or more natural persons (also known as "users"),
 and one natural person might have access to one or more <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑧">user accounts</a>,
-depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>.</p>
+depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-consent">User Consent</dfn>
     <dd data-md>
      <p>User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts.
 An <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①①">authorization gesture</a> is a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑨">ceremony</a> component often employed to indicate <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent④">user consent</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-handle">User Handle</dfn>
     <dd data-md>
-     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
+     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">Discoverable credentials</a> store this identifier and MUST return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
      <p>The main use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle④">user handle</a> is to identify the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⓪">user account</a> in such <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑨">authentication ceremonies</a>,
 but the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑥">credential ID</a> could be used instead.
 The main differences are
-that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑦">authenticator</a> and is unique for each credential,
-while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> and ought to be the same
+that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">authenticator</a> and is unique for each credential,
+while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a> and ought to be the same
 for all <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑤">credentials</a> registered to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①①">user account</a>.</p>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑧">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential sources</a>.
-As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a>. Therefore
-a secondary use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑧">user handle</a> is to allow <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑨">authenticators</a> to know when to replace an existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credential</a> with a new one during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration ceremony</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential sources</a>.
+As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑦">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a>. Therefore
+a secondary use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑧">user handle</a> is to allow <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑥">authenticators</a> to know when to replace an existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credential</a> with a new one during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration ceremony</a>.</p>
      <p>A user handle is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence①">byte sequence</a> with a maximum size of 64 bytes, and is not meant to be displayed to the user.
 It MUST NOT contain personally identifying information, see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="concept-user-present">User Present</dfn>
@@ -2343,23 +2352,23 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 "<a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present">present</a>".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-verification">User Verification</dfn>
     <dd data-md>
-     <p>The technical process by which an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⓪">authenticator</a> <em>locally authorizes</em> the invocation of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential③">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①">authenticatorGetAssertion</a> operations. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑨">User verification</a> MAY be instigated
+     <p>The technical process by which an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑦">authenticator</a> <em>locally authorizes</em> the invocation of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential③">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①">authenticatorGetAssertion</a> operations. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑨">User verification</a> MAY be instigated
 through various <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①②">authorization gesture</a> modalities; for example, through a touch plus pin code, password entry, or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition②">biometric recognition</a> (e.g., presenting a fingerprint) <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>. The intent is to
 distinguish individual users.
 See also <a href="#sctn-authentication-factor-capability">§ 6.2.3 Authentication Factor Capability</a>.</p>
-     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a> a concrete identification of the user,
+     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a> a concrete identification of the user,
 but when 2 or more ceremonies with <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①①">user verification</a> have been done with that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑥">credential</a> it expresses that it was the same user that performed all of them.
 The same user might not always be the same natural person, however,
-if multiple natural persons share access to the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a>.</p>
+if multiple natural persons share access to the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑧">authenticator</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> Distinguishing natural persons depends in significant part upon the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①③">client platform</a>'s
-and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a>'s capabilities.
+and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑨">authenticator</a>'s capabilities.
 For example, some devices are intended to be used by a single individual,
 yet they may allow multiple natural persons to enroll fingerprints or know the same PIN
 and thus access the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①②">user account</a>(s) using that device.</p>
      <div class="note" role="note">
        Note: Invocation of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential④">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②">authenticatorGetAssertion</a> operations
     implies use of key material managed by the authenticator. 
-      <p>Also, for security, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①②">user verification</a> and use of <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑥">credential private keys</a> must all occur within the logical security boundary defining the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a>.</p>
+      <p>Also, for security, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①②">user verification</a> and use of <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑥">credential private keys</a> must all occur within the logical security boundary defining the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⓪">authenticator</a>.</p>
      </div>
      <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①③">User verification</a> procedures MAY implement <a data-link-type="dfn" href="#rate-limiting" id="ref-for-rate-limiting①">rate limiting</a> as a protection against brute force attacks.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="concept-user-verified">User Verified</dfn>
@@ -2368,8 +2377,8 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
    </dl>
    <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-authentication-api">Web Authentication API</dfn></span><a class="self-link" href="#sctn-api"></a></h2>
    <p>This section normatively specifies the API for creating and using <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⓪">public key credentials</a>. The basic
-idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
-browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
+idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
+browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
    <figure id="fig-registration">
      <img src="images/webauthn-registration-flow-01.svg"> 
     <figcaption>Registration Flow</figcaption>
@@ -2393,12 +2402,12 @@ <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5.
 a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
 the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
 is created as well as in all assertions produced by WebAuthn credentials.</p>
-   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
-credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
-Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥④">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Party</a> can only be used in operations
+   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
+credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
+Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥②">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> can only be used in operations
 requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
-where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origins</a>.</p>
-   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑥">authenticator</a> for
+where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origins</a>.</p>
+   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator</a> for
 each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context">secure contexts</a>.
 For web contexts in particular,
 this only includes those accessed via a secure transport (e.g., TLS) established without errors.</p>
@@ -2411,7 +2420,7 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential②"><c- g>PublicKeyCredential</c-></a> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential②"><c- n>Credential</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>              <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export data-readonly data-type="ArrayBuffer" id="dom-publickeycredential-rawid"><code><c- g>rawId</c-></code></dfn>;
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject①"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse"><c- n>AuthenticatorResponse</c-></a>    <a class="idl-code" data-link-type="attribute" data-readonly data-type="AuthenticatorResponse" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response①"><c- g>response</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①"><c- b>DOMString</c-></a>?               <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
+    <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①"><c- b>DOMString</c-></a>?                            <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs"><c- n>AuthenticationExtensionsClientOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="getClientExtensionResults()" id="dom-publickeycredential-getclientextensionresults"><code><c- g>getClientExtensionResults</c-></code></dfn>();
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise①"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isConditionalMediationAvailable()" id="dom-publickeycredential-isconditionalmediationavailable"><code><c- g>isConditionalMediationAvailable</c-></code></dfn>();
     <a data-link-type="idl-name" href="#typedefdef-publickeycredentialjson" id="ref-for-typedefdef-publickeycredentialjson"><c- n>PublicKeyCredentialJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="toJSON()" id="dom-publickeycredential-tojson"><code><c- g>toJSON</c-></code></dfn>();
@@ -2427,19 +2436,19 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
      <p>This attribute returns the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①">ArrayBuffer</a></code> contained in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-identifier-slot" id="ref-for-dom-publickeycredential-identifier-slot①">[[identifier]]</a></code> internal slot.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-response"><code>response</code></dfn>, <span> of type <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse①">AuthenticatorResponse</a>, readonly</span>
     <dd data-md>
-     <p>This attribute contains the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>'s response to the client’s request to either create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②④">public key
+     <p>This attribute contains the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥④">authenticator</a>'s response to the client’s request to either create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②④">public key
 credential</a>, or generate an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑧">authentication assertion</a>. If the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential④">PublicKeyCredential</a></code> is created in response to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③">create()</a></code>, this attribute’s value will be an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse">AuthenticatorAttestationResponse</a></code>, otherwise,
 the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑤">PublicKeyCredential</a></code> was created in response to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑨">get()</a></code>, and this attribute’s value
 will be an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse①">AuthenticatorAssertionResponse</a></code>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②">DOMString</a>, readonly, nullable</span>
     <dd data-md>
      <p>This attribute reports the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality">authenticator attachment modality</a> in effect at the time the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⓪">navigator.credentials.get()</a></code> methods successfully complete.
-The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Parties</a> SHOULD treat unknown values
+The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Parties</a> SHOULD treat unknown values
 as if the value were null.</p>
      <div class="note" role="note">
        Note: If, as the result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⓪">authentication ceremony</a>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment①">authenticatorAttachment</a></code>'s value is "cross-platform" and
-concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
-      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑧">authenticator’s</a> <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①">attachment modality</a> could change over time.
+concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
+      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①">attachment modality</a> could change over time.
 For example, a mobile phone might at one time only support <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment">platform attachment</a> but later receive updates to support <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment">cross-platform attachment</a> as well.</p>
      </div>
     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults">getClientExtensionResults()</a></code>
@@ -2454,7 +2463,7 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson">toJSON()</a></code>
     <dd data-md>
      <p>This operation returns <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson">RegistrationResponseJSON</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson">AuthenticationResponseJSON</a></code>,
-which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
+which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
 but MUST take additional steps to first encode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②">ArrayBuffer</a></code> values to <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③">DOMString</a></code> values
 using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①">base64url encoding</a>.</p>
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-registrationresponsejson-clientextensionresults" id="ref-for-dom-registrationresponsejson-clientextensionresults">RegistrationResponseJSON.clientExtensionResults</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationresponsejson-clientextensionresults" id="ref-for-dom-authenticationresponsejson-clientextensionresults">AuthenticationResponseJSON.clientExtensionResults</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults①">getClientExtensionResults()</a></code>,
@@ -2466,7 +2475,9 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponsejson-publickeyalgorithm" id="ref-for-dom-authenticatorattestationresponsejson-publickeyalgorithm">AuthenticatorAttestationResponseJSON.publicKeyAlgorithm</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm">getPublicKeyAlgorithm()</a></code>.</p>
    </dl>
 <pre class="idl highlight def"><c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-base64urlstring"><code><c- g>Base64URLString</c-></code></dfn>;
-<c- b>typedef</c-> (<a data-link-type="idl-name" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson①"><c- n>RegistrationResponseJSON</c-></a> <c- b>or</c-> <a data-link-type="idl-name" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson①"><c- n>AuthenticationResponseJSON</c-></a>) <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></dfn>;
+// The structure of this object will be either
+// RegistrationResponseJSON or AuthenticationResponseJSON
+<c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-object" id="ref-for-idl-object"><c- b>object</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></dfn>;
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></dfn> {
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-registrationresponsejson-id"><code><c- g>id</c-></code><a class="self-link" href="#dom-registrationresponsejson-id"></a></dfn>;
@@ -2530,11 +2541,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
 The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑨">credential ID</a> is used to look up credentials for use, and is therefore expected to be globally unique
 with high probability across all credentials of the same type, across all authenticators.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This API does not constrain
-the format or length of this identifier, except that it MUST be sufficient for the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑨">authenticator</a> to uniquely select a key.
+the format or length of this identifier, except that it MUST be sufficient for the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑥">authenticator</a> to uniquely select a key.
 For example, an authenticator without on-board storage may create identifiers containing a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑦">credential private key</a> wrapped with a symmetric key that is burned into the authenticator.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-clientextensionsresults-slot"><code>[[clientExtensionsResults]]</code></dfn>
     <dd data-md>
-     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①①">navigator.credentials.get()</a></code>.</p>
+     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①①">navigator.credentials.get()</a></code>.</p>
    </dl>
    <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⓪">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object②">interface object</a> inherits <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑥">Credential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, and defines its own
 implementation of each of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-store-slot" id="ref-for-dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a></code>.</p>
@@ -2554,7 +2565,7 @@ <h4 class="heading settled" data-level="5.1.2" id="sctn-credentialrequestoptions
    <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span class="secno">5.1.3. </span><span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-createCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)">
      <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①①">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="[[Create]](origin, options, sameOriginWithAncestors)" id="dom-publickeycredential-create-slot"><code>[[Create]](origin,
-options, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⓪">authenticator</a>. This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
+options, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a>. This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions. 
     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑦">internal method</a> accepts three arguments:</p>
     <dl>
@@ -2599,13 +2610,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout">timeout</a></code></code> is present, check if its value lies within a
 reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑦">client</a> and if not, correct it to the closest value lying within that range. Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout①">timeout</a></code></code> is not
 present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client①⑧">client</a>-specific default.</p>
-      <p>Recommended ranges and defaults for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout②">timeout</a></code></code> are as follows.</p>
-      <ul>
-       <li data-md>
-        <p>Recommended range: 300000 milliseconds to 600000 milliseconds.</p>
-       <li data-md>
-        <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
-      </ul>
+      <p>See the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</a> for guidance on deciding a reasonable range and default for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout②">timeout</a></code></code>.</p>
       <p class="note" role="note"><span class="marker">Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
      <li data-md>
       <p>If the length of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user①">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①">id</a></code></code> is not between 1 and 64 bytes (inclusive) then throw a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#exceptiondef-typeerror" id="ref-for-exceptiondef-typeerror">TypeError</a></code>.</p>
@@ -2709,8 +2714,8 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
      <li data-md>
       <p>Let <var>issuedRequests</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set">ordered set</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑦">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item②">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦①">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑧">client platform</a> at that instant.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦②">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑦">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item②">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑧">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑧">client platform</a> at that instant.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑨">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⓪">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
 or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑨">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⓪">client</a>.</p>
      <li data-md>
       <p>Consider the value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-hints" id="ref-for-dom-publickeycredentialcreationoptions-hints">hints</a></code> and craft the user interface accordingly, as the user-agent sees fit.</p>
@@ -2819,9 +2824,9 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
             <p>Let <var>enterpriseAttestationPossible</var> be <code>false</code>.</p>
           </dl>
          <li data-md>
-          <p>Let <var>attestationFormats</var> be a list of strings, initialized to the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats">attestationFormats</a></code></code>.</p>
+          <p>Let <var>attestationFormats</var> be a list of strings, initialized to the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats">attestationFormats</a></code></code>.</p>
          <li data-md>
-          <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation①">attestation</a></code></code></p>
+          <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation①">attestation</a></code></code></p>
           <dl class="switch">
            <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none">none</a></code>
            <dd data-md>
@@ -2836,7 +2841,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
             <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports②">transports</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty③">is not empty</a>, and <var>authenticator</var> is connected over a transport not
 mentioned in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports③">transports</a></code></code>, the client MAY <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue⑧">continue</a>.</p>
             <p class="note" role="note"><span class="marker">Note:</span> If the client chooses to <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue⑨">continue</a>, this could result in
-inadvertently registering multiple credentials <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑧">bound to</a> the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> if the transport hints in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports④">transports</a></code></code> are not accurate.
+inadvertently registering multiple credentials <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑧">bound to</a> the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦①">authenticator</a> if the transport hints in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports④">transports</a></code></code> are not accurate.
 For example, stored transport hints could become inaccurate
 as a result of software upgrades adding new connectivity options.</p>
            <li data-md>
@@ -2859,7 +2864,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove④">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate⑥">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel③">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑤">remove</a> it from <var>issuedRequests</var>.</p>
-          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">Authenticators</a> may return an indication of "the user cancelled the entire operation".
+          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦②">Authenticators</a> may return an indication of "the user cancelled the entire operation".
 How a user agent manifests this state to users is unspecified.</p>
         </ol>
        <dt data-md>If any <var>authenticator</var> returns an error status equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror">InvalidStateError</a></code>",
@@ -2873,11 +2878,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <p>Throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑦">DOMException</a></code>.</p>
         </ol>
         <p class="note" role="note"><span class="marker">Note:</span> This error status is handled separately because the <var>authenticator</var> returns it only if <var>excludeCredentialDescriptorList</var> identifies a credential <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑨">bound</a> to the <var>authenticator</var> and the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑥">consented</a> to the operation. Given this explicit consent, it is acceptable for this case to be
-distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Party</a>.</p>
+distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a>.</p>
        <dt data-md>If any <var>authenticator</var> returns an error status not equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>",
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑧">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
+        <p class="note" role="note"><span class="marker">Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
 details.</p>
        <dt data-md>If any <var>authenticator</var> indicates success,
        <dd data-md>
@@ -2913,23 +2918,23 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
 same:</p>
               <ol>
                <li data-md>
-                <p>If the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data">attested credential data</a> is 16 zero bytes, <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult">attestationObjectResult</a>.fmt</code> is "packed", and "x5c" is absent from <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult①">attestationObjectResult</a></code>, then <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation④">self attestation</a> is being used and no further action is needed.</p>
+                <p>If the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data">attested credential data</a> is 16 zero bytes, <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult">attestationObjectResult</a>.fmt</code> is "packed", and "x5c" is absent from <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult①">attestationObjectResult</a></code>, then <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation④">self attestation</a> is being used and no further action is needed.</p>
                <li data-md>
                 <p>Otherwise</p>
                 <ol>
                  <li data-md>
-                  <p>Replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
+                  <p>Replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
                  <li data-md>
                   <p>Set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult②">attestationObjectResult</a>.fmt</code> to "none", and set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult③">attestationObjectResult</a>.attStmt</code> to be an empty <a data-link-type="dfn" href="#cbor" id="ref-for-cbor③">CBOR</a> map. (See <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> and <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>).</p>
                 </ol>
               </ol>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect">indirect</a></code>
              <dd data-md>
-              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a> with a more privacy-friendly
+              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">aaguid</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a> with a more privacy-friendly
 and/or more easily verifiable version of the same data (for example, by employing an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca">Anonymization CA</a>).</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-direct" id="ref-for-dom-attestationconveyancepreference-direct">direct</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise①">enterprise</a></code>
              <dd data-md>
-              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a>'s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a>.</p>
+              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a>.</p>
             </dl>
            <li data-md>
             <p>Let <var>attestationObject</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑤">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor①">%ArrayBuffer%</a>, containing the
@@ -2958,9 +2963,9 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-transports-slot" id="ref-for-dom-authenticatorattestationresponse-transports-slot">[[transports]]</a></code>
                <dd data-md>
                 <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①①">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
-                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a> behavior may be suboptimal.</p>
+                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a> behavior may be suboptimal.</p>
                 <p>If the user agent does not have any transport information, it SHOULD set this field to the empty sequence.</p>
-                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a>.</p>
+                <p class="note" role="note"><span class="marker">Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext" title="FIDO U2F Authenticator Transports Extension">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a>.</p>
               </dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot①">[[clientExtensionsResults]]</a></code>
              <dd data-md>
@@ -2984,16 +2989,16 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
    </div>
    <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a> script optionally specifies some criteria
-to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
-decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Party</a> script optionally specifies some criteria
+to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
+decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credential</a>.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①④">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credentials</a> that
 should be available without <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated②">user mediation</a> (roughly, this specification’s <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①③">authorization gesture</a>), and if it does not find
 exactly one of those, it then calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]]()</a></code></code> to have
-the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>.</p>
+the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a>.</p>
    <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertions</a>, the <code>PublicKeyCredential.<dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-collectfromcredentialstore-slot"><code>[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</code></dfn></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①①">internal method</a> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-collectfromcredentialstore-slot" id="ref-for-dom-credential-collectfromcredentialstore-slot①">Credential.[[CollectFromCredentialStore]]()</a></code>, of returning an empty set.</p>
    <p>In general, the user agent SHOULD show some UI to the user to guide them in selecting and authorizing an authenticator with which
-to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional④">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> script SHOULD first check that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> returns <code>true</code> in order to avoid
+to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional④">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a> script SHOULD first check that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> returns <code>true</code> in order to avoid
 the possibility of causing a user-visible error to be returned if the user agent does not support <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated③">user mediation</a>.</p>
    <p>This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
@@ -3046,13 +3051,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout">timeout</a></code></code> is present, check if its value lies
 within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②②">client</a> and if not, correct it to the closest value lying within that range.
 Set a timer <var>lifetimeTimer</var> to this adjusted value. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code></code> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a>-specific default.</p>
-        <p>Recommended ranges and defaults for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code></code> are as follows.</p>
-        <ul>
-         <li data-md>
-          <p>Recommended range: 300000 milliseconds to 600000 milliseconds.</p>
-         <li data-md>
-          <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
-        </ul>
+        <p>See the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout①">recommended range and default for a WebAuthn ceremony timeout</a> for guidance on deciding a reasonable range and default for <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code></code>.</p>
         <p class="note" role="note"><span class="marker">Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
       </ol>
      <li data-md>
@@ -3126,11 +3125,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>savedCredentialIds</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑧">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
 or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a>.</p>
      <li data-md>
-      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
+      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a>.</p>
      <li data-md>
       <p>Consider the value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-hints" id="ref-for-dom-publickeycredentialrequestoptions-hints">hints</a></code> and craft the user interface accordingly, as the user-agent sees fit.</p>
      <li data-md>
@@ -3149,9 +3148,17 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①②">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑧">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①③">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Then
 throw the <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal③">signal</a></code></code>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-abort-reason" id="ref-for-abortsignal-abort-reason③">abort reason</a>.</p>
-       <dt id="GetAssn-ConditionalMediation-Interact-FormControl"><a class="self-link" href="#GetAssn-ConditionalMediation-Interact-FormControl"></a> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation③">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑧">conditional</a></code> and the user interacts with an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element①">input</a></code> or <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element" id="ref-for-the-textarea-element">textarea</a></code> form control with an <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete" id="ref-for-attr-fe-autocomplete">autocomplete</a></code> attribute whose value
-      contains a <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens①">autofill detail token</a>, 
+       <dt id="GetAssn-ConditionalMediation-Interact-FormControl"><a class="self-link" href="#GetAssn-ConditionalMediation-Interact-FormControl"></a> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation③">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑧">conditional</a></code> and the user interacts with an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element①">input</a></code> or <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element" id="ref-for-the-textarea-element">textarea</a></code> form control with an <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete" id="ref-for-attr-fe-autocomplete">autocomplete</a></code> attribute whose <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type" id="ref-for-non-autofill-credential-type">non-autofill credential type</a> is <code>"webauthn"</code>, 
        <dd data-md>
+        <div class="note" role="note">
+          Note: The <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens①">autofill detail token</a> must appear immediately after the last <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens②">autofill detail token</a> of type "Normal" or "Contact". For example: 
+         <ul>
+          <li data-md>
+           <p><code>"username webauthn"</code></p>
+          <li data-md>
+           <p><code>"current-password webauthn"</code></p>
+         </ul>
+        </div>
         <ol>
          <li data-md>
           <p>If <var>silentlyDiscoveredCredentials</var> is not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty③">empty</a>:</p>
@@ -3223,7 +3230,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①④">For each</a> remaining <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑨">authenticatorCancel</a> operation
 on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①⑥">remove</a> it from <var>issuedRequests</var>.</p>
-          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">Authenticators</a> may return an indication of "the user cancelled the entire operation".
+          <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">Authenticators</a> may return an indication of "the user cancelled the entire operation".
 How a user agent manifests this state to users is unspecified.</p>
         </ol>
        <dt data-md>If any <var>authenticator</var> returns an error status,
@@ -3246,17 +3253,17 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
             <p>whose value is the bytes of <var>clientDataJSON</var>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-authenticatordataresult">authenticatorDataResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a>.</p>
+            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧①">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-signatureresult">signatureResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a>.</p>
+            <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-userhandleresult">userHandleResult</dfn></code>
            <dd data-md>
-            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
+            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a> returned a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult">userHandleResult</a> to be the bytes of
 the returned <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⓪">user handle</a>. Otherwise, set the value of <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult①">userHandleResult</a> to null.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-assertionattestation">assertionAttestation</dfn></code>
            <dd data-md>
-            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a> returned an <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-assertionattestation" id="ref-for-assertioncreationdata-assertionattestation">assertionAttestation</a> to be the bytes of
+            <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a> returned an <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a>, set the value of <a data-link-type="dfn" href="#assertioncreationdata-assertionattestation" id="ref-for-assertioncreationdata-assertionattestation">assertionAttestation</a> to be the bytes of
 the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation statement</a>. Otherwise set it to null.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-clientextensionresults">clientExtensionResults</dfn></code>
            <dd data-md>
@@ -3321,16 +3328,16 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
    </div>
    <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2. </span><span class="content"><dfn class="dfn-paneled algorithm" data-algorithm="Issuing a credential request to an authenticator" data-dfn-for="PublicKeyCredential" data-dfn-type="dfn" data-noexport id="publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</dfn></span><a class="self-link" href="#sctn-issuing-cred-request-to-authenticator"></a></h5>
    <p>This sub-algorithm of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]]()</a></code> encompasses the specific UI context-independent
-steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
+steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
 It is called by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]]()</a></code> from various points depending on which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑤">user mediation</a> the present <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremony</a> is subject to (e.g.: <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①③">conditional</a></code> mediation).</p>
    <p>This algorithm accepts the following arguments:</p>
    <dl>
     <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-authenticator"><code>authenticator</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-authenticator"></a></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
+     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
     <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"><code>savedCredentialIds</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"></a></dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
+     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
     <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-pkoptions"><code>pkOptions</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-pkoptions"></a></dfn>
     <dd data-md>
      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions③">PublicKeyCredentialRequestOptions</a></code> object specifying the desired attributes of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑨">public key credential</a> to discover.</p>
@@ -3374,7 +3381,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
        <p>Let <var>userVerification</var> be <code>false</code>.</p>
      </dl>
     <li data-md>
-     <p>Let <var>enterpriseAttestationPossible</var> be a Boolean value, as follows. If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation">attestation</a></code></code></p>
+     <p>Let <var>enterpriseAttestationPossible</var> be a Boolean value, as follows. If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation">attestation</a></code></code></p>
      <dl class="switch">
       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise②">enterprise</a></code>
       <dd data-md>
@@ -3384,9 +3391,9 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
        <p>Let <var>enterpriseAttestationPossible</var> be <code>false</code>.</p>
      </dl>
     <li data-md>
-     <p>Let <var>attestationFormats</var> be a list of strings, initialized to the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestationformats" id="ref-for-dom-publickeycredentialrequestoptions-attestationformats">attestationFormats</a></code></code>.</p>
+     <p>Let <var>attestationFormats</var> be a list of strings, initialized to the value of <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestationformats" id="ref-for-dom-publickeycredentialrequestoptions-attestationformats">attestationFormats</a></code></code>.</p>
     <li data-md>
-     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation①">attestation</a></code></code></p>
+     <p>If <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation①">attestation</a></code></code></p>
      <dl class="switch">
       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none②">none</a></code>
       <dd data-md>
@@ -3413,7 +3420,7 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
 value (see <a href="#authenticatorGetAssertion-return-values">here</a> in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> for more information).</p>
         <li data-md>
          <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑥">For each</a> credential descriptor <var>C</var> in <var>allowCredentialDescriptorList</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append③">append</a> each value, if any, of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑦">transports</a></code></code> to <var>distinctTransports</var>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
         <li data-md>
          <p>If <var>distinctTransports</var></p>
          <dl class="switch">
@@ -3434,9 +3441,9 @@ <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-t
       <dd data-md>
        <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑥">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>userVerification</var>, <var>enterpriseAttestationPossible</var>, <var>attestationFormats</var>,
 and <var>authenticatorExtensions</var> as parameters.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
+       <p class="note" role="note"><span class="marker">Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
     authenticator is being asked to exercise any credential it may possess that is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑨">scoped</a> to
-    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a>, as identified by <var>rpId</var>.</p>
+    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a>, as identified by <var>rpId</var>.</p>
      </dl>
     <li data-md>
      <p>Return <code>true</code>.</p>
@@ -3475,7 +3482,7 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-isUserVerifyingPlatformA
 Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
 If any are discovered, the promise is resolved with the value of <code>true</code>.
 Otherwise, the promise is resolved with the value of <code>false</code>.
-Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> can take further actions to guide the user to create a credential.</p>
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> can take further actions to guide the user to create a credential.</p>
     <p>This method has no arguments and returns a Boolean value.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑥"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
@@ -3486,11 +3493,11 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-isUserVerifyingPlatformA
    <h4 class="heading settled" data-level="5.1.8" id="sctn-isPasskeyPlatformAuthenticatorAvailable"><span class="secno">5.1.8. </span><span class="content">Availability of a <a data-link-type="dfn" href="#passkey-platform-authenticator" id="ref-for-passkey-platform-authenticator">passkey platform authenticator</a> - PublicKeyCredential’s <code>isPasskeyPlatformAuthenticatorAvailable()</code> Method</span><a class="self-link" href="#sctn-isPasskeyPlatformAuthenticatorAvailable"></a></h4>
    <div data-link-for-hint="WebAuthentication/isPasskeyPlatformAuthenticatorAvailable">
     <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to determine whether they can create a new <a data-link-type="dfn" href="#passkey" id="ref-for-passkey">passkey</a> using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑤">user-verifying platform authenticator</a> or a <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> authenticator.
-Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">user-verifying platform authenticators</a> and the 
+Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">user-verifying platform authenticators</a> and the
 availability of <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid①">hybrid</a></code> transport.
 If one or both are discovered, the promise is resolved with the value of <code>true</code>.
 If neither is discovered, the promise is resolved with the value of <code>false</code>.
-Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> can take further actions to guide the user to create a <a data-link-type="dfn" href="#passkey" id="ref-for-passkey①">passkey</a>.</p>
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> can take further actions to guide the user to create a <a data-link-type="dfn" href="#passkey" id="ref-for-passkey①">passkey</a>.</p>
     <p>This method has no arguments and returns a Boolean value.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑦"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑥"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isPasskeyPlatformAuthenticatorAvailable()" id="dom-publickeycredential-ispasskeyplatformauthenticatoravailable"><code><c- g>isPasskeyPlatformAuthenticatorAvailable</c-></code><a class="self-link" href="#dom-publickeycredential-ispasskeyplatformauthenticatoravailable"></a></dfn>();
@@ -3574,10 +3581,10 @@ <h4 class="heading settled" data-level="5.1.10" id="sctn-parseRequestOptionsFrom
 </pre>
    </div>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
 };
 </pre>
    <div>
@@ -3589,13 +3596,13 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestationresponse"><span class="secno">5.2.1. </span><span class="content">Information About Public Key Credential (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorattestationresponse"><code>AuthenticatorAttestationResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorattestationresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a>'s response to a client’s request
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a>'s response to a client’s request
 for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a>. It contains information about the new credential that can be used to
 identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a> to assess the characteristics of the credential
 during registration.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext②"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed②"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse③"><c- g>AuthenticatorAttestationResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse④"><c- n>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑦"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject②"><c- g>attestationObject</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑦"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject②"><c- g>attestationObject</c-></a>;
     <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥"><c- b>DOMString</c-></a>>                              <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getTransports()" id="dom-authenticatorattestationresponse-gettransports"><code><c- g>getTransports</c-></code></dfn>();
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑧"><c- b>ArrayBuffer</c-></a>                                      <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getAuthenticatorData()" id="dom-authenticatorattestationresponse-getauthenticatordata"><code><c- g>getAuthenticatorData</c-></code></dfn>();
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑨"><c- b>ArrayBuffer</c-></a>?                                     <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKey()" id="dom-authenticatorattestationresponse-getpublickey"><code><c- g>getPublicKey</c-></code></dfn>();
@@ -3614,7 +3621,7 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
 tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation
 statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>,
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
@@ -3630,13 +3637,13 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier③">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑨">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑨">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
    <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
@@ -3647,19 +3654,19 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
      <p>-8 (EdDSA), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves" id="ref-for-name-double-coordinate-curves①">crv</a> is 6 (Ed25519).</p>
    </ul>
    <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm②">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
-   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
+   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a>'s response to a client’s request for
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a>'s response to a client’s request for
 generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
 optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse④"><c- g>AuthenticatorAssertionResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑥"><c- n>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑤"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②②"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑥"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②③"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature①"><c- g>signature</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑦"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②④"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle③"><c- g>userHandle</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑧"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑤"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject①"><c- g>attestationObject</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②②"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑤"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②③"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature①"><c- g>signature</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑥"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②④"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle③"><c- g>userHandle</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑦"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑤"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject①"><c- g>attestationObject</c-></a>;
 };
 </pre>
    <div>
@@ -3682,7 +3689,7 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
 and MAY return one otherwise.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-attestationobject"><code>attestationObject</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑨">ArrayBuffer</a>, readonly, nullable</span>
      <dd data-md>
-      <p>This OPTIONAL attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑦">attestation object</a>, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a> supports attestation in assertions. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑧">attestation object</a>, if present, includes an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>. Unlike the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> in an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code>, it does not contain an <code>authData</code> key because the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">authenticator data</a> is provided directly in an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code> structure. For more details on attestation, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-attestation-in-assertions">§ 6.5.1 Attestation in assertions</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>, and <a href="#fig-attStructs">Figure 6</a>.</p>
+      <p>This OPTIONAL attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑦">attestation object</a>, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> supports attestation in assertions. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑧">attestation object</a>, if present, includes an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>. Unlike the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> in an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code>, it does not contain an <code>authData</code> key because the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">authenticator data</a> is provided directly in an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code> structure. For more details on attestation, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-attestation-in-assertions">§ 6.5.1 Attestation in assertions</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>, and <a href="#fig-attStructs">Figure 6</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><span class="secno">5.3. </span><span class="content">Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialparameters"><code>PublicKeyCredentialParameters</code></dfn>)</span><a class="self-link" href="#dictionary-credential-params"></a></h3>
@@ -3726,7 +3733,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></span>
      <dd data-md>
-      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> responsible for the request.</p>
+      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> responsible for the request.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
@@ -3736,20 +3743,20 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
      <dd data-md>
       <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a></p>
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
-      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> signs, along with other data,
+      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a> signs, along with other data,
 when producing an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑨">attestation object</a> for the newly created credential.
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
-      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a> supports,
+      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Party</a> supports,
 ordered from most preferred to least preferred.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
+The <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
 If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> operation fails.</p>
-      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></code> values:</p>
+      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></code> values:</p>
       <ul>
        <li data-md>
         <p>-8 (Ed25519)</p>
@@ -3761,42 +3768,42 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>Additional signature algorithms can be included as needed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
-      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> is willing to wait for the call to complete. This is
+      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> is willing to wait for the call to complete. This is
 treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
-This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
-If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a>,
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
+This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
+If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a>,
 or return an error if that fails.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
-that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
+that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③③">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
       <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints">PublicKeyCredentialHints</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a>, defaulting to <code>"none"</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑥">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">member does not exist</a>.</p>
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③">none</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
       <p>The default value is the empty list, which indicates no preference.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a>.
-For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a>.
+For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity"><span class="secno">5.4.1. </span><span class="content">Public Key Entity Description (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialentity"><code>PublicKeyCredentialEntity</code></dfn>)</span><a class="self-link" href="#dictionary-pkcredentialentity"></a></h4>
@@ -3810,46 +3817,49 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
       <ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a>, intended only
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a>, intended only
 for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".</p>
         <ul>
          <li data-md>
-          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤">name</a></code>'s value, or displaying the value to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
           <p><a data-link-type="dfn" href="#client" id="ref-for-client④⓪">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. It is intended only for display, i.e., aiding the user in determining the difference between user
-accounts with similar <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④">displayName</a></code>s. For example, "alexm", "alex.mueller@example.com"
-or "+14255551234".</p>
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. This
+identifier is the primary value displayed to users by <a data-link-type="dfn" href="#client" id="ref-for-client④①">Clients</a> to help users
+understand with which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> a credential is associated.</p>
+        <p>Examples of suitable values for this identifier include, "alexm", "+14255551234",
+"alex.mueller@example.com", "alex.mueller@example.com (prod-env)",
+or "alex.mueller@example.com (ОАО Примертех)".</p>
         <ul>
          <li data-md>
-          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a> SHOULD perform enforcement,
+          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Party</a> SHOULD perform enforcement,
 as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS
 IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value, or displaying the value
 to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④①">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client④②">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑧">authenticatorMakeCredential</a> operation.</p>
         </ul>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④②">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④③">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
       <p>Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> member’s value so that it fits within 64 bytes, if the authenticator stores the value. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> attributes when creating a new credential.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> attributes when creating a new credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑧"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨"><c- g>id</c-></a>;
 };
@@ -3858,48 +3868,52 @@ <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-para
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨">DOMString</a></span>
      <dd data-md>
-      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
+      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-params"><span class="secno">5.4.3. </span><span class="content">User Account Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentity"><code>PublicKeyCredentialUserEntity</code></dfn>)</span><a class="self-link" href="#dictionary-user-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> attributes when creating a new
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a> attributes when creating a new
 credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity④"><c- g>PublicKeyCredentialUserEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity④"><c- n>PublicKeyCredentialEntity</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource   " href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥"><c- g>id</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤"><c- g>displayName</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④"><c- g>displayName</c-></a>;
 };
 </pre>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑤">BufferSource</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a>.
+      <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⓪">user account</a>.
 A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence②">byte sequence</a> with a maximum size of 64 bytes,
 and is not meant to be displayed to the user.</p>
       <p>To ensure secure operation, authentication and authorization
-decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
+decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a>.</p>
       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑥">user handle</a> MUST NOT contain personally identifying information about the user, such as a username or e-mail address;
 see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a> for details. The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> MUST NOT be empty.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⓪">user accounts</a>,
+      <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user accounts</a>,
 even for <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credentials</a>, because some authenticators always create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credentials</a>.
 Thus a constant <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> would prevent a user from using such an authenticator
-with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a>.</p>
+with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a>, intended only for display. For example, "Alex Müller" or "田中倫". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑤">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a>, intended only for
+display. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice
+more than necessary. If no suitable or <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑥">human-palatable</a> name is
+available, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a> SHOULD set this value to an empty string.</p>
+      <p>Examples of suitable values for this identifier include, "Alex Müller", "Alex Müller (ACME Co.)" or "田中倫".</p>
       <ul>
        <li data-md>
-        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value, or displaying the value to the user.</p>
+        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code>'s value, or displaying the value to the user.</p>
        <li data-md>
-        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="#client" id="ref-for-client④③">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value prior to displaying the value to the user or
+        <p><a data-link-type="dfn" href="#client" id="ref-for-client④④">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④④">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
-      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelection"><span class="secno">5.4.4. </span><span class="content">Authenticator Selection Criteria (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorselectioncriteria"><code>AuthenticatorSelectionCriteria</code></dfn>)</span><a class="self-link" href="#dictionary-authenticatorSelection"></a></h4>
@@ -3916,7 +3930,7 @@ <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelec
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤">DOMString</a></span>
      <dd data-md>
-      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
+      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
 If this member is absent, then any attachment modality is acceptable.
 The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values,
 treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
@@ -3925,20 +3939,20 @@ <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelec
 in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">get()</a></code> operation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③">residentKey</a></code>'s values and semantics.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
 The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -3956,9 +3970,9 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
     </dl>
    </div>
    <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options,
-sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
+sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
@@ -3967,27 +3981,27 @@ <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement">
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
+   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
-For example, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credential</a> if possible.
+For example, the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
-This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops③">Credential Properties Extension</a>.
+This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference②"><c- g>AttestationConveyancePreference</c-></a> {
@@ -4002,27 +4016,27 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a>,
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a>.
 The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
-in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> through unmodified.</p>
+in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> in this case.
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
-      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
+      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
@@ -4043,71 +4057,71 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑦">BufferSource</a></span>
     <dd data-md>
-     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> is willing to wait for the call to complete.
-The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a>.</p>
+     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> is willing to wait for the call to complete.
+The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a> MUST verify
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> MUST verify
 that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.</p>
      <p>If not specified, its value will
 be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object④">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
+     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>.
 It can be used in two ways:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a>.
-This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.</p>
+       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.
+This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a>.</p>
        <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
-This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> —
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> will automatically ignore non-eligible credentials
+This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> optimize the user experience for any given situation.
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> —
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> will automatically ignore non-eligible credentials
 if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a> to authenticate is not already identified,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
+       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> to authenticate is not already identified,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
 In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremony</a>,
-and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>,
-the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
+and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code>.
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a>,
+the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
      <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
      <p>The list is ordered in descending order of preference: the first item in the list is the most
 preferred credential, and the last is the least preferred.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>'s values and semantics.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-hints"><code>hints</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
      <p>This OPTIONAL member contains zero or more elements from <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints①">PublicKeyCredentialHints</a></code> to guide the user agent in interacting with the user. Note that the elements have type <code>DOMString</code> despite being taken from that enumeration. See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④">DOMString</a>, defaulting to <code>"none"</code></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a>.
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>.</p>
      <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑤">none</a></code>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a>.
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
      <p>The default value is the empty list, which indicates no preference.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span class="secno">5.6. </span><span class="content">Abort Operations with <code>AbortSignal</code></span><a class="self-link" href="#sctn-abortoperation"></a></h3>
    <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
@@ -4124,41 +4138,41 @@ <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span clas
     loses focuses. If a hook is provided, the above paragraph will be updated to include the hook.
     See <a href="https://github.com/whatwg/html/issues/2711">WHATWG HTML WG Issue #2711</a> for more details.</p>
    <h3 class="heading settled" data-level="5.7" id="sctn-extensions-inputs-outputs"><span class="secno">5.7. </span><span class="content">WebAuthn Extensions Inputs and Outputs</span><a class="self-link" href="#sctn-extensions-inputs-outputs"></a></h3>
-   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn extension</a> inputs and outputs.</p>
+   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn extension</a> inputs and outputs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output">Authenticator extension outputs</a> are conveyed as a part of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a> (see <a href="#table-authData">Table 1</a>).</p>
    <p class="note" role="note"><span class="marker">Note:</span> The types defined below — <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs④">AuthenticationExtensionsClientInputs</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs③">AuthenticationExtensionsClientOutputs</a></code> — are applicable to both <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①">authentication extensions</a>. The "Authentication..." portion of their names should be regarded as meaning "WebAuthentication..."</p>
    <h4 class="heading settled" data-level="5.7.1" id="iface-authentication-extensions-client-inputs"><span class="secno">5.7.1. </span><span class="content">Authentication Extensions Client Inputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑤">AuthenticationExtensionsClientInputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-inputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputs"><code><c- g>AuthenticationExtensionsClientInputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.2" id="iface-authentication-extensions-client-outputs"><span class="secno">5.7.2. </span><span class="content">Authentication Extensions Client Outputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs④">AuthenticationExtensionsClientOutputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-outputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputs"><code><c- g>AuthenticationExtensionsClientOutputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensions-authenticator-inputs"><span class="secno">5.7.3. </span><span class="content">Authentication Extensions Authenticator Inputs (CDDL type <code>AuthenticationExtensionsAuthenticatorInputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-inputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorInputs = {
   * $$extensionInput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
   * $$extensionOutput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl①">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorOutputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑥">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
    <h3 class="heading settled" data-level="5.8" id="sctn-supporting-data-structures"><span class="secno">5.8. </span><span class="content">Supporting Data Structures</span><a class="self-link" href="#sctn-supporting-data-structures"></a></h3>
    <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
 follows.</p>
    <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span class="secno">5.8.1. </span><span class="content">Client Data Used in <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature">WebAuthn Signatures</a> (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-collectedclientdata"><code>CollectedClientData</code></dfn>)</span><a class="self-link" href="#dictionary-client-data"></a></h4>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a>. It is a key-value
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a>. It is a key-value
 mapping whose keys are strings. Values can be any type that has a valid encoding in JSON. Its structure is defined by the
 following Web IDL.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata②">CollectedClientData</a></code> may be extended in the future. Therefore it’s critical when parsing to be tolerant of unknown keys and of any reordering of the keys. See also <a href="#clientdatajson-verification">§ 5.8.1.2 Limited Verification Algorithm</a>.</p>
@@ -4186,7 +4200,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
 attacks (where an attacker substitutes one legitimate signature for another).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a> of the requester, as provided to the authenticator by the client, in
@@ -4203,28 +4217,28 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
      <dt data-md>[RESERVED] <dfn data-dfn-for="CollectedClientData" data-dfn-type="dfn" data-noexport id="collectedclientdata-tokenbinding">tokenBinding<a class="self-link" href="#collectedclientdata-tokenbinding"></a></dfn>
      <dd data-md>
       <p>This OPTIONAL member contains information about the state of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1">Token Binding</a> protocol <a data-link-type="biblio" href="#biblio-tokenbinding" title="The Token Binding Protocol Version 1.0">[TokenBinding]</a> used when communicating
-with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
-      <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a></code> field is reserved so that it will not be reused for a different purpose.</p>
+with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
+      <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <code class="idl"><a data-link-type="idl">tokenBinding</a></code> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
         <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑥">DOMString</a></span>
         <dd data-md>
-         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
+         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
          <div>
           <dl>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;supported&quot;|supported" id="dom-tokenbindingstatus-supported"><code>supported</code></dfn>
            <dd data-md>
-            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>.</p>
+            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>.</p>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;present&quot;|present" id="dom-tokenbindingstatus-present"><code>present</code></dfn>
            <dd data-md>
-            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
+            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
           </dl>
          </div>
          <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
         <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦">DOMString</a></span>
         <dd data-md>
          <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url
-encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>.</p>
+encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a>.</p>
        </dl>
       </div>
       <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platform</a>-specific operation.</p>
@@ -4419,8 +4433,8 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
 };
 </pre>
    <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
-It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a>.
+It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a>,
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a>.
 It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
    <div>
     <dl>
@@ -4428,19 +4442,20 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
      <dd data-md>
       <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
       <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code>.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> If all <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> elements in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code> are ignored then that MUST result in an error since an empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> is semantically distinct.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
       <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
       <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦①">DOMString</a>></span>
      <dd data-md>
-      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platforms</a> MUST ignore unknown values.</p>
+      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platforms</a> MUST ignore unknown values.</p>
       <p>This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
 of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> operation.
 When <a href="#sctn-registering-a-new-credential">registering a new credential</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
-When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> for that credential,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> SHOULD retrieve that stored value
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
+When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> for that credential,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> SHOULD retrieve that stored value
 and set it as the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> member.</p>
     </dl>
    </div>
@@ -4456,28 +4471,28 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport④">AuthenticatorTransport</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">clients</a>. This enumeration
+     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> can be contacted over removable USB.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a> can be contacted over removable USB.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;nfc&quot;|nfc" id="dom-authenticatortransport-nfc"><code>nfc</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;ble&quot;|ble" id="dom-authenticatortransport-ble"><code>ble</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;smart-card&quot;|smart-card" id="dom-authenticatortransport-smart-card"><code>smart-card</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> can be contacted over ISO/IEC 7816 smart card with contacts.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-authenticatortransport-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;internal&quot;|internal" id="dom-authenticatortransport-internal"><code>internal</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
 i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform authenticator</a>.
 These authenticators are not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑨">client device</a>.</p>
     </dl>
@@ -4517,16 +4532,16 @@ <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirem
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> cannot be performed.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -4539,20 +4554,20 @@ <h4 class="heading settled" data-level="5.8.7" id="enum-hints"><span class="secn
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialhints" id="ref-for-enumdef-publickeycredentialhints③">PublicKeyCredentialHints</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
+     <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Parties</a> may use this enumeration to communicate hints to the user-agent about how a request may be best completed. These hints are not requirements, and do not bind the user-agent, but may guide it in providing the best experience by using contextual information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> has about the request. Hints are provided in order of decreasing preference so, if two hints are contradictory, the first one controls. Hints may also overlap: if a more-specific hint is defined a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> may still wish to send less specific ones for user-agents that may not recognise the more specific one. In this case the most specific hint should be sent before the less-specific ones. 
     <p>Hints MAY contradict information contained in credential <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment②">authenticatorAttachment</a></code>. When this occurs, the hints take precedence. (Note that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①③">transports</a></code> values are not provided when using <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credentials</a>, leaving hints as the only avenue for expressing some aspects of such a request.)</p>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;security-key&quot;|security-key" id="dom-publickeycredentialhints-security-key"><code>security-key</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> believes that users will satisfy this request with a physical security key. For example, an enterprise <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> may set this hint if they have issued security keys to their employees and will only accept those <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticators</a> for <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> and <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment③">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform①">cross-platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;client-device&quot;|client-device" id="dom-publickeycredentialhints-client-device"><code>client-device</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> believes that users will satisfy this request with a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> attached to the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment④">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform①">platform</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialHints" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-publickeycredentialhints-hybrid"><code>hybrid</code></dfn>
      <dd data-md>
-      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
+      <p>Indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> believes that users will satisfy this request with general-purpose <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticators</a> such as smartphones. For example, a consumer <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> may believe that only a small fraction of their customers possesses dedicated security keys. This option also implies that the local <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform authenticator</a> should not be promoted in the UI.</p>
       <p>For compatibility with older user agents, when this hint is used in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>, the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment⑤">authenticatorAttachment</a></code> SHOULD be set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform②">cross-platform</a></code>.</p>
     </dl>
    </div>
@@ -4566,22 +4581,22 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
    <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
 To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span class="secno">6. </span><span class="content">WebAuthn <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-model">Authenticator Model</dfn></span><a class="self-link" href="#sctn-authenticator-model"></a></h2>
    <p><a href="#sctn-api">The Web Authentication API</a> implies a specific abstract functional model for a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticator</a>. This section
 describes that <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model②">authenticator model</a>.</p>
    <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
 Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a>, MUST be indistinguishable
 from the behavior specified in <a href="#sctn-api">§ 5 Web Authentication API</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
 the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②①">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a>. For instance, this abstract model does not define protocols for
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -4589,16 +4604,17 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 operates at a higher security level than the rest of the authenticator. This is particularly important for authenticators that
 are embedded in the WebAuthn client, as in those cases this cryptographic module (which may, for example, be a TPM) could be
 considered more trustworthy than the rest of the authenticator.</p>
-   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a>.</p>
-   <p>Additionally, each authenticator has an AAGUID, which is a 128-bit identifier indicating the type (e.g. make and model) of the
-authenticator. The AAGUID MUST be chosen by the manufacturer to be identical across all substantially identical authenticators
-made by that manufacturer, and different (with high probability) from the AAGUIDs of all other types of authenticators.
-The AAGUID for a given type of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Party</a> MAY use the AAGUID to infer certain
-properties of the authenticator, such as certification level and strength of key protection, using information from other sources.</p>
+   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a>.</p>
+   <p>Additionally, each authenticator has an Authenticator Attestation Globally Unique Identifier or <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="aaguid">AAGUID</dfn>, which is a 128-bit identifier
+indicating the type (e.g. make and model) of the authenticator. The AAGUID MUST be chosen by its maker to be identical across all substantially identical
+authenticators made by that maker, and different (with high probability) from the AAGUIDs of all other types of authenticators. The AAGUID for a given type
+of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> MAY use the AAGUID to infer certain properties of the authenticator, such as
+certification level and strength of key protection, using information from other sources. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> MAY use the AAGUID to attempt to identify the maker of
+the authenticator without requesting and verifying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a>, but the AAGUID is not provably authentic without <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
 referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
 sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a>.</p>
@@ -4611,7 +4627,7 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
      <p>The data processed by the authenticator should be small and easy to interpret in low-level code. In particular, authenticators
 should not have to parse high-level encodings such as JSON.</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
+     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
     <li data-md>
      <p>The design aims to reuse as much as possible of existing encoding formats in order to aid adoption and implementation.</p>
    </ul>
@@ -4619,25 +4635,25 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <ol>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> provides cryptographic
-proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
-signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①③">attestation</a> desired.
-For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
+proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
+signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a> desired.
+For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="assertion-signature">assertion signature</dfn> is produced when the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑦">authenticatorGetAssertion</a> method is invoked. It represents an
-assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
-in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
+assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
+in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
 same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a>. It also asserts additional
 information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">user consent</a> was
-provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
+provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
    </ol>
    <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
 The formats of these signatures, as well as the procedures for generating them, are specified below.</p>
    <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span class="secno">6.1. </span><span class="content">Authenticator Data</span><a class="self-link" href="#sctn-authenticator-data"></a></h3>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a>. These bindings are
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>. These bindings are
 controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⓪">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
 limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">client platform</a>.</p>
@@ -4682,17 +4698,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
           <p>Bit 3: <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility①">Backup Eligibility</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-be">BE</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 4: <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state①">Backup State</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-bs">BS</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
           </ul>
          <li data-md>
           <p>Bit 5: Reserved for future use (<code>RFU2</code>).</p>
@@ -4728,12 +4744,12 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
         present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a>. </figcaption>
    </figure>
-   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
+   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a> is generated.
 However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> of a
 credential does not change between operations but instead remains the same for the lifetime of that credential. Secondly, it is
 validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> that
-the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a>.</p>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure</dfn>:</p>
+the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a>.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure</dfn>:</p>
    <ul>
     <li data-md>
      <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash">rpIdHash</a>.</p>
@@ -4763,15 +4779,15 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -4787,7 +4803,7 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
    <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑦">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
    <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
@@ -4807,39 +4823,39 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
       <tr>
        <td><code>1</code>
        <td><code>0</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>. 
       <tr>
        <td><code>1</code>
        <td><code>1</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
     </table>
     <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
    <ul>
     <li data-md>
-     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticators</a>:</p>
+     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticators</a>:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registered</a> and/or an account recovery process in place.
-For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credentials</a>.</p>
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registered</a> and/or an account recovery process in place.
+For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
-to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a>,
-such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
+to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a>,
+such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><span class="secno">6.2. </span><span class="content">Authenticator Taxonomy</span><a class="self-link" href="#sctn-authenticator-taxonomy"></a></h3>
-   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> used.
+   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> used.
 This section defines some terminology for those capabilities, their most important combinations,
 and which use cases those combinations enable.</p>
    <p>For example:</p>
@@ -4851,9 +4867,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
      <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> is likely the most convenient
 since it’s built directly into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑥">client device</a> rather than being a separate device that the user may have to locate.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a> can be used.</p>
+     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a> can be used.</p>
     <li data-md>
-     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
+     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
     <li data-md>
      <p>A laptop computer might support connecting to <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⓪">roaming authenticators</a> via USB and Bluetooth,
 while a mobile phone might only support NFC.</p>
@@ -4861,9 +4877,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform</a> authenticator,
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform</a> authenticator,
 or in some cases both — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a>.</p>
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a>.</p>
     <li data-md>
      <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
     <li data-md>
@@ -4917,22 +4933,22 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 In addition to the proof of possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⓪">credential private key</a>,
 these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a>.</p>
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a>.</p>
    <p>The combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①③">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
 where the user is automatically identified by the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②①">user handle</a> and possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①①">credential private key</a> is used as the only <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⓪">authentication factor</a>.
-This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a>.</p>
+This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">multi-factor</a> authentication, but requires the user to be identified first
 which risks leaking personally identifying information; see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
    </ul>
    <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality②">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
    <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment-modality"><span class="secno">6.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-attachment-modality">Authenticator Attachment Modality</dfn></span><a class="self-link" href="#sctn-authenticator-attachment-modality"></a></h4>
-   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦①">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
-and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticators</a> that
+   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦②">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
+and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticators</a> that
 are part of the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a> as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-authenticators">platform authenticators</dfn>, while those that are reachable via cross-platform
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
@@ -4946,8 +4962,8 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
    </ul>
    <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
-while <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
+while <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> and communicating with the same authenticator via Bluetooth
 would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a>.</p>
    <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
@@ -4957,53 +4973,53 @@ <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment
    <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> shared between multiple users,
 or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a>;
-and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
+and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client devices</a> it is used with.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
-backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> is lost.</p>
+backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
-     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
+     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can use it.</p>
    </ol>
-   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
+   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
    <ul>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
-credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
+credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
 credential capable</dfn>.</p>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
 modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private keys</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
-   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> MAY
+   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> MAY
 at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code>.</p>
    <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-capability"><span class="secno">6.2.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-factor-capability">Authentication Factor Capability</dfn></span><a class="self-link" href="#sctn-authentication-factor-capability"></a></h4>
    <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication
 ceremony</a>: <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a>, <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">something you know</a> and <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you are</a>. Examples include a physical key, a password,
 and a fingerprint, respectively.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user
-verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> can
-verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> that is
-not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a>.</p>
+   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user
+verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> can
+verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> that is
+not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
 session to exist at any particular time, or by providing more complicated session management.</p>
    <p>The following operations can be invoked by the client in an authenticator session.</p>
    <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-credid"><span class="secno">6.3.1. </span><span class="content">Lookup Credential Source by Credential ID Algorithm</span><a class="self-link" href="#sctn-op-lookup-credsource-by-credid"></a></h4>
-   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
+   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> <var>credSource</var>:</p>
+     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
        <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> to <var>credentialId</var>.</p>
@@ -5011,7 +5027,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
@@ -5027,13 +5043,13 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a>.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
      <p>The constant Boolean value <code>true</code>.
@@ -5041,14 +5057,14 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
 wish to make a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test of user presence</a> optional although WebAuthn does not.</p>
     <dt data-md><var>requireUserVerification</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -5056,15 +5072,15 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>, if any.</p>
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> based on
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
@@ -5090,10 +5106,10 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
          <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" and terminate the operation.</p>
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> is not to proceed with creating a credential,
-but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a>.
+but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a>.
 If the user does not consent,
-the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
+the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
      </ol>
     <li data-md>
@@ -5105,7 +5121,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
     <li id="op-makecred-step-user-consent">
      <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⓪">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user consent</a> for creating a new credential.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> is shown by the
-    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code></code>, if possible. 
+    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code></code>, if possible. 
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①⓪">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a> fails, return an error code equivalent to
@@ -5119,7 +5135,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
       <li data-md>
        <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
       <li data-md>
-       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> with the fields:</p>
+       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> with the fields:</p>
        <dl>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
@@ -5164,7 +5180,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input②">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a>:</p>
+     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticator</a>:</p>
      <dl class="switch">
       <dt data-md>is a U2F device
       <dd data-md>
@@ -5201,7 +5217,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -5216,20 +5232,20 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑨">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
-   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential sources</a>.</p>
     <li data-md>
      <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
@@ -5247,10 +5263,10 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
-     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
+     <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
     Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> may be shown
-    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
+    by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> if it has its own output capability, or by the user agent otherwise. 
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a>, return an error code equivalent to
@@ -5260,8 +5276,8 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input④">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
      <p>Increment the credential associated <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⓪">signature counter</a> or the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②①">signature counter</a> value, depending on
-which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>, by some positive value.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
+which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a>, by some positive value.
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
 zero.</p>
     <li data-md>
      <p>If <var>attestationFormats</var>:</p>
@@ -5309,7 +5325,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span class="marker">Note:</span> In cases where <var>allowCredentialDescriptorList</var> was supplied the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult⑤">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5323,9 +5339,9 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a>.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a>.</p>
    </dl>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Let <var>collectedDiscoverableCredentialMetadata</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑥">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①①">items</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata">DiscoverableCredentialMetadata</dfn> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct④">structs</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①⓪">items</a>:</p>
@@ -5344,10 +5360,10 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
        <p>A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user handle</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-otherui">otherUI</dfn>
       <dd data-md>
-       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticator</a> to inform its UI.</p>
+       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a> to inform its UI.</p>
      </dl>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a>.</p>
@@ -5362,17 +5378,17 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
      <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①③">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
-   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
+   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
    <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
    <figure id="fig-stringTruncation">
      <img src="images/string-truncation.svg"> 
     <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
    </figure>
-   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
+   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
    <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
-   <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticators</a>, user agents SHOULD:</p>
+   <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticators</a>, user agents SHOULD:</p>
    <ol>
     <li data-md>
      <p>Ensure that any strings sent to authenticators are validly encoded.</p>
@@ -5380,7 +5396,7 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
      <p>Handle the case where strings have been truncated resulting in an invalid encoding. For example, any partial code point at the end may be dropped or replaced with <a href="http://unicode.org/cldr/utility/character.jsp?a=FFFD">U+FFFD</a>.</p>
    </ol>
    <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span class="secno">6.4.2. </span><span class="content">Language and Direction Encoding</span><a class="self-link" href="#sctn-strings-langdir"></a></h4>
-   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
+   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
    <p>To encode language and direction metadata in a string that is documented as permitting it, suffix its code points with two sequences of code points:</p>
    <p>The first encodes a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1①">language tag</a> with the code point U+E0001 followed by the ASCII values of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1②">language tag</a> each shifted up by U+E0000. For example, the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1③">language tag</a> “en-US” becomes the code points U+E0001, U+E0065, U+E006E, U+E002D, U+E0055, U+E0053.</p>
    <p>The second consists of a single code point which is either U+200E (“LEFT-TO-RIGHT MARK”), U+200F (“RIGHT-TO-LEFT MARK”), or U+E007F (“CANCEL TAG”). The first two can be used to indicate directionality but SHOULD only be used when neccessary to produce the correct result. (E.g. an RTL string that starts with LTR-strong characters.) The value U+E007F is a direction-agnostic indication of the end of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1④">language tag</a>.</p>
@@ -5393,17 +5409,17 @@ <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span c
    </ul>
    <p>Consumers of strings that may have language and direction encoded should be aware that truncation could truncate a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1⑤">language tag</a> into a different, but still valid, language. The final directionality marker or CANCEL TAG code point provide an unambigous indication of truncation.</p>
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, if possible.
-If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> can
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestation</a>, if possible.
+If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a> can
 produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
-enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
+enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private key</a>,
 or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>.</p>
-   <p>All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, and optionally when exercised, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①④">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
-   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
-for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a>.</p>
+   <p>All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, and optionally when exercised, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①④">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
+for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> to base a trust decision on.
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
     <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑤">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> from a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">create()</a></code> operation (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">attested credential
@@ -5412,44 +5428,44 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑤">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑥">attestation statement
   formats</a> are defined in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. </div>
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
-data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> that created it. It
+data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
 attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
-bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a>. In other words, this defines the
+bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticator</a>. In other words, this defines the
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.3 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a>, after verifying that it
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
 "packed" <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement format</a> defined in <a href="#sctn-packed-attestation">§ 8.2 Packed Attestation Statement Format</a> can be used in conjunction with all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②">attestation
 types</a>, while other formats and types have more limited applicability.</p>
-   <p>The privacy, security and operational characteristics of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑨">attestation</a> depend on:</p>
+   <p>The privacy, security and operational characteristics of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestation</a> depend on:</p>
    <ul>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type③">attestation type</a>, which determines the trust model,</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attestation</a> by limiting what can be
+     <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②③">attestation</a> by limiting what can be
 expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a>, and</p>
     <li data-md>
-     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a>, such as its construction, whether part or all of it runs in a secure
+     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters, or those with the same names in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code>.</p>
-   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">attestation statement
-formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> will also need to
-understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters, or those with the same names in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code>.</p>
+   <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">attestation statement
+formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> will also need to
+understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attestation-in-assertions"><span class="secno">6.5.1. </span><span class="content">Attestation in assertions</span><a class="self-link" href="#sctn-attestation-in-assertions"></a></h4>
-   <p>Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> using the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation③">attestation</a></code> parameter, attestation MAY be provided in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertions</a>.</p>
+   <p>Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> using the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation③">attestation</a></code> parameter, attestation MAY be provided in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertions</a>.</p>
    <p>Attestations in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertions</a> could be helpful in at least the following situations:</p>
    <ol>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>, the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator④">generating authenticator</a> may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a> to observe these changes.</p>
+     <p>For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credentials</a>, the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator④">generating authenticator</a> may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a> to observe these changes.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①③">attestation statement format</a> involves a 3rd-party attesting to the state of the authenticator, then returning an attestation with each use of the credential allows for the continued good health of the authenticator to be attested.</p>
    </ol>
@@ -5467,7 +5483,7 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attested-credential-data
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-aaguid">aaguid</dfn>
        <td>16
-       <td>The AAGUID of the authenticator.
+       <td>The <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid②">AAGUID</a> of the authenticator.
       <tr>
        <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialidlength">credentialIdLength</dfn>
        <td>2
@@ -5547,7 +5563,7 @@ <h5 class="heading settled" data-level="6.5.2.1" id="sctn-encoded-credPubKey-exa
 <c- p>}</c->
 </pre>
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-formats"><span class="secno">6.5.3. </span><span class="content">Attestation Statement Formats</span><a class="self-link" href="#sctn-attestation-formats"></a></h4>
-   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①④">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> MUST be defined using the following
+   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①④">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> MUST be defined using the following
 template:</p>
    <ul>
     <li data-md>
@@ -5585,12 +5601,12 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-formats"><sp
    <h4 class="heading settled" data-level="6.5.4" id="sctn-attestation-types"><span class="secno">6.5.4. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
    <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
 calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑥">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
-section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
+section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 23</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
-Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is acceptable
-under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a> policy.</p>
+Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a> is acceptable
+under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
     <dd data-md>
@@ -5604,17 +5620,17 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-attestation-types"><span
 Authenticators without meaningful protection measures for an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key②">attestation private key</a> typically use this attestation type.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-ca">Attestation CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attca">AttCA</dfn>)
     <dd data-md>
-     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
-"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a> can generate multiple
+     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
+"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
-for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticator</a> can limit the exposure of the EK (which is a global correlation
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
     certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statement</a>.</p>
@@ -5635,7 +5651,7 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-generating-an-attestatio
     <dd data-md>
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">hash of the serialized client data</a>.</p>
    </dl>
-   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a> MUST:</p>
+   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> MUST:</p>
    <ol>
     <li data-md>
      <p>Let <var>attStmt</var> be the result of running <var>attestationFormat</var>’s <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure①">signing procedure</a> given <var>authData</var> and <var>hash</var>.</p>
@@ -5671,7 +5687,7 @@ <h4 class="heading settled" data-level="6.5.6" id="sctn-signature-attestation-ty
     |  4e 72 23 6e a3 90 a9 a1  7b cf 5f 7a 09 d6 3a b2
     |  17 6c 92 bb 8e 36 c0 41  98 a2 7b 90 9b 6e 8f 13
 </pre>
-     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
    </ul>
    <p>It is RECOMMENDED that any new attestation formats defined not use ASN.1 encodings,
     but instead represent signatures as equivalent fixed-length byte arrays without internal structure,
@@ -5688,23 +5704,23 @@ <h4 class="heading settled" data-level="6.5.6" id="sctn-signature-attestation-ty
 The signature is not ASN.1 wrapped.</p>
    </ul>
    <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a>'s script receives
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a>'s script receives
 a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑨">AuthenticatorAssertionResponse</a></code> structure,
-respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> server, using methods outside
-the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> must perform upon receipt of these
+respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> server, using methods outside
+the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①②">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as
 might be determinable from the context available in the rejected promise. For example if the promise is rejected with
-an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a>.
+an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a>.
 For information on different error contexts and the circumstances leading to them, see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>.</p>
     <li data-md>
      <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑤">response</a></code></code>.
@@ -5726,17 +5742,17 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
-    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a>.
+    <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> expects that this credential would have been created within an iframe that is
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li data-md>
@@ -5744,31 +5760,31 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑧">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑨">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑨">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a>.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
     <li id="reg-ceremony-verify-extension-outputs">
      <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey①">devicePubKey</a> extension has explicit verification procedures, see <a href="#sctn-device-publickey-extension-verification-create">§ 10.2.2.3.1 Registration (create())</a>.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys①">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-create">§ 10.2.2.3.1 Registration (create())</a>.</p>
     <li data-md>
      <p>Determine the attestation statement format by performing a USASCII case-sensitive match on <var>fmt</var> against the set of
 supported WebAuthn Attestation Statement Format Identifier values.
@@ -5781,14 +5797,14 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
     <li id="reg-ceremony-attestation-trust-anchors"><a class="self-link" href="#reg-ceremony-attestation-trust-anchors"></a> If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates)
     for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. For
-    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑥">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
+    example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>. 
     <li id="reg-ceremony-assess-trust">
      <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 21</a>, as follows: 
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate
 (i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">Step 22</a> may be the same).</p>
@@ -5796,11 +5812,11 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
-    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
+    then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
     with the following contents: 
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-type" id="ref-for-abstract-opdef-credential-record-type①">type</a>
@@ -5809,7 +5825,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
-whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a>.</p>
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-publickey" id="ref-for-abstract-opdef-credential-record-publickey">publicKey</a>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
@@ -5829,7 +5845,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dd data-md>
        <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flag</a> in <var>authData</var>.</p>
      </dl>
-     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> MAY also include the following OPTIONAL contents:</p>
+     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> MAY also include the following OPTIONAL contents:</p>
      <dl>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject①">attestationObject</a>
       <dd data-md>
@@ -5840,22 +5856,22 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      </dl>
     <li data-md>
      <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 23</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> is asserting there
-    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> model.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
+    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> is asserting there
+    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②③">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> has a trusted method of determining acceptable trust anchors
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②③">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> has a trusted method of determining acceptable trust anchors
 in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> above.
-Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
@@ -5868,22 +5884,22 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults③">getClientExtensionResults()</a></code></code>.</p>
     <li data-md>
-     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①⑤">is not empty</a>,
-verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code></code>.</p>
+     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty①⑤">is not empty</a>,
+verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code></code>.</p>
     <li data-md>
-     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>:</p>
+     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>:</p>
      <dl class="switch">
       <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a> was initiated, e.g., via a username or cookie,
       <dd data-md>
-       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a>.
+       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id②">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a>.
 If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
-verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a>.</p>
+verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a>.</p>
       <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremony</a> was initiated,
       <dd data-md>
        <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is present.
-Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
-Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a>.</p>
+Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> whose <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential record</a>.</p>
      </dl>
     <li data-md>
      <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①⓪">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata③">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
@@ -5901,20 +5917,20 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a>.
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> expects to be sub-framed within.
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a>. 
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.</p>
@@ -5926,7 +5942,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> business logic or policy,
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> business logic or policy,
 let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> bits, respectively,
 of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var>.
 Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code>:</p>
@@ -5936,20 +5952,20 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible③">backupEligible</a></code> is not set, verify that <var>currentBe</var> is not set.</p>
       <li data-md>
-       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> policy, if any.</p>
+       <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> policy, if any.</p>
      </ol>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
     <li id="authn-ceremony-verify-extension-outputs">
      <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey②">devicePubKey</a> extension has explicit verification procedures, see <a href="#sctn-device-publickey-extension-verification-get">§ 10.2.2.3.2 Authentication (get())</a>.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys②">supplementalPubKeys</a> extension has explicit verification procedures, see <a href="#sctn-supplemental-public-keys-extension-verification-get">§ 10.2.2.3.2 Authentication (get())</a>.</p>
     <li data-md>
      <p>Let <var>hash</var> be the result of computing a hash over the <var>cData</var> using SHA-256.</p>
     <li data-md>
@@ -5969,13 +5985,13 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
         <dd>This is a signal that
           the authenticator may be cloned, i.e. at least
           two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential private key</a> may exist and are
-          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Parties</a> should incorporate this information
+          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> should incorporate this information
           into their risk scoring.
-          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a>-specific. 
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a>-specific. 
        </dl>
      </ul>
     <li data-md>
-     <p>If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject③">attestationObject</a></code></code> is present and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a> wishes to verify the attestation then perform CBOR decoding on <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject④">attestationObject</a></code> to obtain the attestation statement format <var>fmt</var>, and the attestation statement <var>attStmt</var>.</p>
+     <p>If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject③">attestationObject</a></code></code> is present and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> wishes to verify the attestation then perform CBOR decoding on <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject④">attestationObject</a></code> to obtain the attestation statement format <var>fmt</var>, and the attestation statement <var>attStmt</var>.</p>
      <ol>
       <li data-md>
        <p>Verify that the <code>AT</code> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> field of <var>authData</var> is set, indicating that <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①④">attested credential data</a> is included.</p>
@@ -5987,7 +6003,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
        <p>Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑦">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>.</p>
        <p class="note" role="note"><span class="marker">Note:</span> Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②②">attestation statement format</a> specifies its own <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑧">verification procedure</a>. See <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a> for the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
       <li data-md>
-       <p>If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates) for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑥">attested credential data</a> can be used to guide this lookup.</p>
+       <p>If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates) for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑥">attested credential data</a> can be used to guide this lookup.</p>
      </ol>
     <li id="authn-ceremony-update-credential-record">
      <a class="self-link" href="#authn-ceremony-update-credential-record"></a> Update <var>credentialRecord</var> with new state values: 
@@ -6005,7 +6021,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
        <p>OPTIONALLY, if <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject⑤">attestationObject</a></code></code> is present,
 update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject②">attestationObject</a></code> to the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject⑥">attestationObject</a></code></code> and update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationclientdatajson" id="ref-for-abstract-opdef-credential-record-attestationclientdatajson①">attestationClientDataJSON</a></code> to the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①①">clientDataJSON</a></code></code>.</p>
      </ol>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a> steps,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a> steps,
     the above state updates SHOULD be deferred to after those additional checks are completed successfully.</p>
     <li data-md>
      <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a>.</p>
@@ -6031,7 +6047,7 @@ <h3 class="heading settled" data-level="8.1" id="sctn-attstn-fmt-ids"><span clas
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.</p>
    <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span class="secno">8.2. </span><span class="content">Packed Attestation Statement Format</span><a class="self-link" href="#sctn-packed-attestation"></a></h3>
    <p>This is a WebAuthn optimized attestation statement format. It uses a very compact but still extensible encoding method. It is
-implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a> with limited resources (e.g., secure elements).</p>
+implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticators</a> with limited resources (e.g., secure elements).</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6082,7 +6098,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
        <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation">authenticator data for the attestation</a>,
 and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">hash of the serialized client data</a>.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#basic" id="ref-for-basic②">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca②">AttCA</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②③">attestation</a> is in use, the authenticator produces the <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>, and signing the result using an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key③">attestation private key</a> selected through an authenticator-specific
+       <p>If <a data-link-type="dfn" href="#basic" id="ref-for-basic②">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca②">AttCA</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a> is in use, the authenticator produces the <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>, and signing the result using an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key③">attestation private key</a> selected through an authenticator-specific
 mechanism. It sets <var>x5c</var> to <var>attestnCert</var> followed by the related certificate chain (if any). It sets <var>alg</var> to the algorithm of the
 attestation private key.</p>
       <li data-md>
@@ -6108,7 +6124,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
          <p>Verify that <var>attestnCert</var> meets the requirements in <a href="#sctn-packed-attestation-cert-requirements">§ 8.2.1 Packed Attestation Statement Certificate Requirements</a>.</p>
         <li data-md>
          <p>If <var>attestnCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the
-value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a></code> in <var>authenticatorData</var>.</p>
+value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑥">aaguid</a></code> in <var>authenticatorData</var>.</p>
         <li data-md>
          <p>Optionally, inspect <var>x5c</var> and consult externally provided knowledge to determine whether <var>attStmt</var> conveys a <a data-link-type="dfn" href="#basic" id="ref-for-basic③">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca③">AttCA</a> attestation.</p>
         <li data-md>
@@ -6152,6 +6168,9 @@ <h4 class="heading settled" data-level="8.2.1" id="sctn-packed-attestation-cert-
     <li data-md>
      <p>If the related attestation root certificate is used for multiple authenticator models, the Extension OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) MUST be present, containing the AAGUID as a 16-byte OCTET STRING.
 The extension MUST NOT be marked as critical.</p>
+     <p>As <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Parties</a> may not know if the attestation root
+certificate is used for multiple authenticator models, it is suggested that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Parties</a> check if the extension
+is present, and if it is, then validate that it contains that same AAGUID as presented in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②④">attestation object</a>.</p>
      <p>Note that an X.509 Extension encodes the DER-encoding of the value in an OCTET STRING.
 Thus, the AAGUID MUST be wrapped in <i>two</i> OCTET STRINGS to be valid. Here is a sample, encoded Extension structure:</p>
 <pre>30 21                                     -- SEQUENCE
@@ -6261,7 +6280,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>Verify that <var>aikCert</var> meets the requirements in <a href="#sctn-tpm-cert-requirements">§ 8.3.1 TPM Attestation Statement Certificate Requirements</a>.</p>
       <li data-md>
        <p>If <var>aikCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the value of this
-extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑨">aaguid</a></code> in <var>authenticatorData</var>.</p>
+extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
        <p>If successful, return implementation-specific values representing <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑨">attestation type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca⑥">AttCA</a> and <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path⑤">attestation trust
 path</a> <var>x5c</var>.</p>
@@ -6286,7 +6305,7 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
@@ -6363,7 +6382,7 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
    <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⓪">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -6456,7 +6475,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
       <dt data-md>sig
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑤">attestation signature</a>.
-The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> from the authenticator.</p>
+The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> from the authenticator.</p>
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
@@ -6511,9 +6530,9 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a> MAY also directly generate attestation statements of this format
-if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> MAY also directly generate attestation statements of this format
+if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attestation</a>.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -6600,6 +6619,41 @@ <h3 class="heading settled" data-level="8.8" id="sctn-apple-anonymous-attestatio
        <p>If successful, return implementation-specific values representing attestation type <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑤">Anonymization CA</a> and attestation trust path <var>x5c</var>.</p>
      </ol>
    </dl>
+   <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><span class="secno">8.9. </span><span class="content">Compound Attestation Statement Format</span><a class="self-link" href="#sctn-compound-attestation"></a></h3>
+   <p>The "compound" attestation statement format is used to pass multiple, self-contained attestation statements in a single ceremony.</p>
+   <dl>
+    <dt data-md>Attestation statement format identifier
+    <dd data-md>
+     <p>compound</p>
+    <dt data-md>Attestation types supported
+    <dd data-md>
+     <p>Any. See <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>.</p>
+    <dt data-md>Syntax
+    <dd data-md>
+     <p>The syntax of a compound attestation statement is defined as follows:</p>
+<pre>$$attStmtType //= (
+                      fmt: "compound",
+                      attStmt: [2* nonCompoundAttStmt]
+                  )
+
+nonCompoundAttStmt = { $$attStmtType } .within { fmt: text .ne "compound" }
+</pre>
+    <dt data-md>Signing procedure
+    <dd data-md>
+     <p>Not applicable</p>
+    <dt data-md>Verification procedure
+    <dd data-md>
+     <p>Given the <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑤">verification procedure inputs</a> <var>attStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>, the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> is
+as follows:</p>
+     <ol>
+      <li data-md>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
+       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> policy.</p>
+      <li data-md>
+       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
+return implementation-specific values representing any combination of outputs from successful <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedures</a>.</p>
+     </ol>
+   </dl>
    <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="secno">9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-extensions">WebAuthn Extensions</dfn></span><a class="self-link" href="#sctn-extensions"></a></h2>
    <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credentials</a>, as well as requesting and generating Authentication assertions, as
 defined in <a href="#sctn-api">§ 5 Web Authentication API</a>, can be extended to suit particular use cases. Each case is addressed by defining a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="registration extension" data-noexport id="registration-extension">registration
@@ -6615,9 +6669,9 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
    <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
-(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
+(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
 processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">Authenticator extensions</a> define the following steps and data:</p>
    <ul>
@@ -6635,18 +6689,18 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤①">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> does not endanger the user’s security or privacy.
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
 that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension inputs</a> from JSON to CBOR
 will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
 being ignored by the authenticator. Since all extensions are OPTIONAL, this will not cause a functional failure in the API
 operation.</p>
    <p>The IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> can be consulted
-for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①①">WebAuthn Extensions</a>.</p>
+for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a>.</p>
    <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class="secno">9.1. </span><span class="content">Extension Identifiers</span><a class="self-link" href="#sctn-extension-id"></a></h3>
    <p>Extensions are identified by a string, called an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="extension-identifier">extension identifier</dfn>, chosen by the extension author.</p>
    <p>Extension identifiers SHOULD be registered in the
@@ -6670,7 +6724,7 @@ <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
    <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> know that the extension was honored by the authenticator. If an
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
@@ -6680,7 +6734,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -6699,8 +6753,8 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 <c- p>});</c->
 </pre>
    <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a>.</p>
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
 authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension
 input</a>,
@@ -6720,7 +6774,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
    <p class="note" role="note"><span class="marker">Note:</span> Extensions should aim to define authenticator arguments that are as small as possible. Some authenticators communicate
     over low-bandwidth links such as Bluetooth Low-Energy or NFC.</p>
    <h3 class="heading settled" data-level="9.4" id="sctn-client-extension-processing"><span class="secno">9.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-processing">Client Extension Processing</dfn></span><a class="self-link" href="#sctn-client-extension-processing"></a></h3>
-   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> during the creation of credentials or the
+   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> during the creation of credentials or the
 generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> for the extension is used as an input to this client processing.
 For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑥">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a> as the value.</p>
    <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults④">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
@@ -6736,7 +6790,7 @@ <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-pr
    <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="unsigned-extension-outputs">Unsigned extension outputs</dfn> are represented independently from <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a> and returned by authenticators
 as a separate map, keyed with the same <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②⓪">extension identifier</a>. This map only contains entries for authenticator
 extensions that make use of unsigned outputs.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> In <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs④">unsigned extension outputs</a> are returned as a CBOR map in a top-level field named <code>unsignedExtensionOutputs</code> from both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑨">authenticatorGetAssertion</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> In <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs④">unsigned extension outputs</a> are returned as a CBOR map in a top-level field named <code>unsignedExtensionOutputs</code> from both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑨">authenticatorGetAssertion</a>.</p>
    <p>For each supported extension, the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing④">authenticator extension processing</a> rule for that extension is used create the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a>, and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑤">unsigned extension output</a> if used, from the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑦">authenticator extension input</a> and possibly also other inputs.
 There MUST NOT be any values returned for ignored extensions.</p>
    <h2 class="heading settled" data-level="10" id="sctn-defined-extensions"><span class="secno">10. </span><span class="content">Defined Extensions</span><a class="self-link" href="#sctn-defined-extensions"></a></h2>
@@ -6748,14 +6802,14 @@ <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
    <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
 order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
-     <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> option
+     <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> option
  of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑧">get()</a></code> method:</p>
      <ul>
       <li data-md>
@@ -6763,7 +6817,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
       <li data-md>
        <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①①">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①②">id</a></code>.</p>
      </ul>
-     <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code> MAY contain a mixture
+     <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> MAY contain a mixture
  of both WebAuthn <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑦">credential IDs</a> and U2F key handles;
  stating the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid①">appid</a></code> via this extension
  does not prevent the user from using a WebAuthn-registered credential
@@ -6775,8 +6829,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
 but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
    <dl>
@@ -6823,7 +6877,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
 };
@@ -6840,7 +6894,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
    <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6879,7 +6933,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just prior to <a href="#CreateCred-InvokeAuthnrMakeCred">invoking authenticatorMakeCredential</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
+         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⑤">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
          <ol>
           <li data-md>
            <p>Check whether <var>C</var> was created using U2F on <var>authenticator</var> by sending a <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> whose "five parts" are set to the following values:</p>
@@ -6915,7 +6969,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
 };
@@ -6931,46 +6985,72 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
-   <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property①">resident key credential property</a> (i.e., <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>).</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> upon creation or use of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>credProps</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
     <dd data-md>
-     <p>None, other than to report on credential properties in the output.</p>
+     <ol>
+      <li data-md>
+       <p>If processed during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>:</p>
+       <ol>
+        <li data-md>
+         <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
+       </ol>
+      <li data-md>
+       <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname①">authenticatorDisplayName</a></code> as described in its definition, using some client-specific procedure.
+If no suitable value is found, let <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname②">authenticatorDisplayName</a></code> be undefined.</p>
+     </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑥">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①"><c- g>rk</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②"><c- g>rk</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname③"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput" id="ref-for-dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="CredentialPropertiesOutput " id="dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput" id="ref-for-dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="CredentialPropertiesOutput " id="dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-credprops"></a></dfn>;
 };
 </pre>
      <div>
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①">boolean</a></span>
        <dd data-md>
-        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn> (i.e., <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn>),
+        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn> (i.e., <dfn data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property<a class="self-link" href="#credentialpropertiesoutput-client-side-discoverable-credential-property"></a></dfn>),
 is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑧">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-authenticatordisplayname"><code>authenticatorDisplayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a></span>
+       <dd data-md>
+        <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
+chosen by the user.</p>
+        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> MUST allow the user to choose this value.
+That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication</a> ceremony or MAY be made available outside
+the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> MAY reuse the same value
+for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a>.</p>
+        <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a>, by some unspecified mechanism, for this
+value. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> MAY allow the user to configure the response to such a
+query. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticator</a> vendor MAY provide a default response to such a query.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> MAY consider a user-configured response chosen by the user,
+and SHOULD allow the user to modify a vendor-provided default response.</p>
+        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential records</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> MAY offer this value, if
+present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a>.</p>
+        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑥">credential record</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑦">credential record</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -6984,18 +7064,18 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
    <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
-   <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
+   <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
    <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> is identical.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>prf</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfvalues"><code><c- g>AuthenticationExtensionsPRFValues</c-></code></dfn> {
@@ -7005,7 +7085,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></dfn> {
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues> " href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues> " href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑨"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7017,9 +7097,9 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-eval"><code>eval</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues②">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
         <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertion</a> is needed in order to obtain the outputs.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑦">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
        <dd data-md>
-        <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> is not empty.</p>
+        <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> is not empty.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①③">registration</a>)
@@ -7030,7 +7110,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <li data-md>
        <p>Set <code>hmac-secret</code> to <code>true</code> in the authenticator extensions input.</p>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval①">eval</a></code> is present and a future extension to <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> permits evaluation of the PRF at creation time, configure <code>hmac-secret</code> inputs accordingly:</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval①">eval</a></code> is present and a future extension to <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> permits evaluation of the PRF at creation time, configure <code>hmac-secret</code> inputs accordingly:</p>
        <ul>
         <li data-md>
          <p>Let <code>salt1</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval②">eval</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first">first</a></code>)</code>.</p>
@@ -7042,16 +7122,13 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <li data-md>
        <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results">results</a></code> to the decrypted PRF result(s), if any.</p>
      </ol>
-   </dl>
-   <p class="note" role="note"><span class="marker">Note:</span> If PRF results are obtained during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> MUST inspect the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flags</a> of the response in order to determine the correct value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑤">userVerification</a></code> for future <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a>. Otherwise results from <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertions</a> may be inconsistent with those from the <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>.</p>
-   <dl>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
       <li data-md>
-       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
+       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
       <li data-md>
        <p>Initialize the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-prf" id="ref-for-dom-authenticationextensionsclientoutputs-prf">prf</a></code> extension output to an empty dictionary.</p>
       <li data-md>
@@ -7077,7 +7154,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
@@ -7093,29 +7170,29 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-enabled"><code>enabled</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①③">boolean</a></span>
        <dd data-md>
-        <p><code>true</code> if, and only if, the one or two PRFs are available for use with the created credential. This is only reported during <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and is not present in the case of <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①④">authentication</a>.</p>
+        <p><code>true</code> if, and only if, the one or two PRFs are available for use with the created credential. This is only reported during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> and is not present in the case of <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①④">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-results"><code>results</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues⑤">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
-        <p>The results of evaluating the PRF for the inputs given in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑦">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑤">evalByCredential</a></code>. Outputs may not be available during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a>; see comments in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑧">eval</a></code>.</p>
+        <p>The results of evaluating the PRF for the inputs given in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑦">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑤">evalByCredential</a></code>. Outputs may not be available during <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>; see comments in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑧">eval</a></code>.</p>
       </dl>
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob">large, per-credential blobs</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
+   <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob">large, per-credential blobs</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
 and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤">required</a></code>.
-However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>.</p>
+However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑨">discoverable credentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>largeBlob</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①⓪"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -7140,10 +7217,10 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -7175,7 +7252,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
          <p>If an <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator">authenticator is selected</a> and the <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator①">selected authenticator</a> supports large blobs, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported①">supported</a></code> to <code>true</code>, and <code>false</code> otherwise.</p>
        </ol>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
@@ -7205,7 +7282,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write③">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> does not contain exactly one element:</p>
+         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> does not contain exactly one element:</p>
          <ol>
           <li data-md>
            <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
@@ -7243,7 +7320,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
@@ -7255,10 +7332,10 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
      <p><code>uvm</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">Authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">Authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②⓪"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
 };
@@ -7337,112 +7414,120 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
             01           -- Subitem 3: CBOR short for Matcher Protection Type Software
 </pre>
    </dl>
-   <h4 class="heading settled" data-level="10.2.2" id="sctn-device-publickey-extension"><span class="secno">10.2.2. </span><span class="content">Device-bound public key extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="devicepubkey">devicePubKey</dfn>)</span><a class="self-link" href="#sctn-device-publickey-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> with a "device continuity" signal for <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials. This is done by creating a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>-specific <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair②">hardware-bound device key pair</a> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>, if such a key pair does not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credential</a> being created or exercised, and returning the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key">device public key</a> along with a signature by the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key①">device private key</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey③">devicePubKey</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> is incapable of generating a <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair③">hardware-bound device key pair</a>, or the registration or authentication operation fails for any reason, this extension is ignored and no <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair④">hardware-bound device key pair</a> is created. In this case, there is no <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey④">devicePubKey</a> extension output generated.</p>
-   <p>The <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑤">hardware-bound device key pair</a> is not on its own a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a> and does not have its own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a>. Instead, the returned <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①">device public key</a> is a device-specific contextual attribute of its associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credential</a> is used—along with the <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑤">devicePubKey</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, a particular <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key②">device public key</a> is returned by the extension, along with a signature demonstrating proof-of-possession of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key②">device private key</a> by that device.</p>
-   <h5 class="heading settled" data-level="10.2.2.1" id="sctn-device-publickey-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-device-publickey-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension provides a "device continuity" signal <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations:</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> uses the <code>devicePubKey</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>, a signature by a new <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①">device-bound key</a> ("dpk 1") is returned along with the new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key③">device public key</a>. Even if the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>, "dpk 1" never leaves the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator⑤">generating authenticator</a> ("authenticator 1"). The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations using the same user credential with that <i>same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a></i> generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①④">assertions</a> including further signatures by the <i>same</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key②">device-bound key</a> ("dpk 1"). This behavior on "authenticator 1" is independent of whether this user credential has been copied to any other <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a>.</p>
-   <p>Then, if this same user credential is copied to a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a> ("authenticator 2"), the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>'s first <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> call on "authenticator 2" (that includes the <code>devicePubKey</code> extension) will produce an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑤">assertion</a> including a signature by a <i>new</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key③">device-bound key</a> ("dpk 2"). Note that such a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a> can be exercised on "authenticator 2" without a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">create()</a></code> having been performed on "authenticator 2". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> calls on "authenticator 2", using the <code>devicePubKey</code> extension and the same user credential, yield further signatures by "dpk 2".</p>
+   <h4 class="heading settled" data-level="10.2.2" id="sctn-supplemental-public-keys-extension"><span class="secno">10.2.2. </span><span class="content">Supplemental public keys extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="supplementalpubkeys">supplementalPubKeys</dfn>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension"></a></h4>
+   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> with additional public key(s) for credentials. This is done by creating <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a>-specific key pairs on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>, when required key pairs do not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a> being created or exercised, and returning these supplemental keys (along with signatures by them) to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys③">supplementalPubKeys</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> is incapable of generating a supplemental key pair, or the registration or authentication operation fails for any reason, that key pair is omitted from the output. If no supplemental key pairs remain then this extension is ignored. In this case, there is no <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys④">supplementalPubKeys</a> extension output generated.</p>
+   <p>Supplemental keys are not <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credentials</a> and they do not have their own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential IDs</a>. Instead, any returned keys are a contextual attribute of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is used—along with the <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑤">supplementalPubKeys</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, a particular set of supplemental keys are returned by the extension, along with signatures demonstrating proof-of-possession of those keys.</p>
+   <p>Supplemental keys never have a scope that is larger than the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑧">user credential</a>. That is, they are never shared between any two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credentials</a> and can never be used to link two <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⓪">user credentials</a> together. They only communicate continuity of some property of their associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①①">user credential</a>.</p>
+   <h5 class="heading settled" data-level="10.2.2.1" id="sctn-supplemental-public-keys-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-usage"></a></h5>
+   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension signals the continuity of some property <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations. The property being signaled depends on the scope of the supplemental key and its <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑧">attestation</a> statement, if any. The clearest example of a supplemental key is one that is device-bound. Repeated observation of a device-bound supplemental key indicates that a credential is being used repeatedly from the same device. (Which cannot be otherwise assumed in the case of <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials.) But supplemental keys with wider scopes are also defined and the exact properties that they communicate depend on the attestation included along with them.</p>
+   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> uses the <code>supplementalPubKeys</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>, a signature by one or more new supplemental keys may be returned along with the new supplemental public keys themselves. For the sake of example, assume that a single supplemental public key is returned, called “SPK1”. For as long as the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a> is exercised within the scope of the supplemental key, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations for that credential will likely generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a> including further signatures by “SPK1”.</p>
+   <p>The credential may move beyond the scope of that supplemental key (for example, by being exported and imported elsewhere, if <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a>) and, if used in this new domain, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> operation will return a <i>new</i> supplemental key, SPK2, and its signature. Subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> operations may observe either SPK1 or SPK2, depending on the context in which the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a> is being used.</p>
    <p>A usage example is thus:</p>
    <blockquote>
-    <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a> on its own. But if a signature by a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key④">device-bound key</a> that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
+    <p>A sign-in request is received by a website that, by regulation, must require certain authentication standards. The sign-in is done with a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a>, but also includes a supplemental key with an attestation that states that the supplemental key is only synced after a user has met or exceeded those standards. Since that supplemental key has been seen before, and was initially verified to meet the site’s authentication standards, additional sign-in challenges are not required.</p>
    </blockquote>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Parties</a> need to take care to verify <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑤">device-bound key</a> signatures before associating and storing extension output value fields in conjunction with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. See <a href="#sctn-device-publickey-extension-verification">§ 10.2.2.3 devicePubKey Extension Output Verification Procedures</a>.</p>
-   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> give to the presence of a signature from a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑥">device-bound key</a> may be based on information learned from its optional attestation. An attestation can indicate the level of protection that the hardware offers the private key, certifications for the hardware, etc.</p>
-   <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-device-publickey-extension-definition"></a></h5>
+   <p>Another example of supplemental keys:</p>
+   <blockquote>
+    <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑨">multi-device credential</a> on its own. But if a signature from a supplemental key that is device-bound, and that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
+   </blockquote>
+   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Parties</a> give to the presence of a signature from a supplemental key may be based on information learned from its optional attestation. An attestation can indicate the level of protection enjoyed by a hardware-bound key, or the policies for other types of supplemental key.</p>
+   <h5 class="heading settled" data-level="10.2.2.2" id="sctn-supplemental-public-keys-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-definition"></a></h5>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
-     <p><code>devicePubKey</code></p>
+     <p><code>supplementalPubKeys</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②③">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②③">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsdevicepublickeyinputs"><code><c- g>AuthenticationExtensionsDevicePublicKeyInputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionsdevicepublickeyinputs-attestation" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation"><c- g>attestation</c-></a> = "none";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②⓪"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑤"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionssupplementalpubkeysinputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysInputs</c-></code></dfn> {
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②⓪"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦④"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②①"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①②"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsdevicepublickeyinputs" id="ref-for-dictdef-authenticationextensionsdevicepublickeyinputs"><c- n>AuthenticationExtensionsDevicePublicKeyInputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsDevicePublicKeyInputs " id="dom-authenticationextensionsclientinputs-devicepubkey"><code><c- g>devicePubKey</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysinputs" id="ref-for-dictdef-authenticationextensionssupplementalpubkeysinputs"><c- n>AuthenticationExtensionsSupplementalPubKeysInputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsSupplementalPubKeysInputs " id="dom-authenticationextensionsclientinputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></dfn>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥">DOMString</a>, defaulting to <code>"none"</code></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-scopes"><code>scopes</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦">DOMString</a>></span>
+       <dd data-md>
+        <p>This required member MUST be non-empty. It specifies the scopes of supplemental public keys that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> requests. Values are taken from the CDDL below (i.e., currently defined values are <code>provider</code> and <code>device</code>); authenticators silently ignore unrecognized values. Specifying the scopes that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> can use allows an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> to avoid the work of generating superfluous supplemental keys.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑧">DOMString</a>, defaulting to <code>"indirect"</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑤">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
-        <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑦">none</a></code>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦">DOMString</a>>, defaulting to <code>[]</code></span>
+        <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect②">indirect</a></code>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑨">DOMString</a>>, defaulting to <code>[]</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑨">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
-This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
+This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
         <p>The default value is the empty list, which indicates no preference.</p>
       </dl>
      </div>
-     <p class="note" role="note"><span class="marker">Note:</span> To request the <code>devicePubKey</code> extension processing with default options, pass an empty dictionary as the input.</p>
     <dt data-md>Client extension processing
     <dd data-md>
-     <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientinputs-devicepubkey">devicePubKey</a></code> is present, the client creates the authenticator extension input from the client extension input.</p>
+     <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientinputs-supplementalpubkeys">supplementalPubKeys</a></code> is present, the client creates the authenticator extension input from the client extension input.</p>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>An ArrayBuffer containing the signature returned as the <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑥">unsigned extension output</a>.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsdevicepublickeyoutputs"><code><c- g>AuthenticationExtensionsDevicePublicKeyOutputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③②"><c- b>ArrayBuffer</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyOutputs" data-dfn-type="dict-member" data-export data-type="ArrayBuffer " id="dom-authenticationextensionsdevicepublickeyoutputs-signature"><code><c- g>signature</c-></code></dfn>;
+     <p>A sequence of <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③②">ArrayBuffer</a></code>s containing the signatures returned as the <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑥">unsigned extension output</a>.</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionssupplementalpubkeysoutputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></code></dfn> {
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②②"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③③"><c- b>ArrayBuffer</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsSupplementalPubKeysOutputs" data-dfn-type="dict-member" data-export data-type="sequence<ArrayBuffer> " id="dom-authenticationextensionssupplementalpubkeysoutputs-signatures"><code><c- g>signatures</c-></code></dfn>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs①②"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsdevicepublickeyoutputs" id="ref-for-dictdef-authenticationextensionsdevicepublickeyoutputs"><c- n>AuthenticationExtensionsDevicePublicKeyOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsDevicePublicKeyOutputs " id="dom-authenticationextensionsclientoutputs-devicepubkey"><code><c- g>devicePubKey</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysoutputs" id="ref-for-dictdef-authenticationextensionssupplementalpubkeysoutputs"><c- n>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsSupplementalPubKeysOutputs " id="dom-authenticationextensionsclientoutputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></dfn>;
 };
 </pre>
     <dt data-md>Authenticator extension input
     <dd data-md>
      <p>A CBOR expression of the client extension input</p>
-<pre>devicePublicKeyInputs = {
-  attestation: "none" / "indirect" / "direct" / "enterprise",
-  attestationFormats: [tstr],
+<pre>supplementalPublicKeyInputs = {
+  scopes: [+
+    ; A key that has a broader scope than a single device, but still more
+    ; limited than a multi-device credential. The precise scope is specified
+    ; by the attestation of this supplemental public key.
+    "provider" /
+
+    ; A key with "device" scope MUST NOT leave the device on which it is
+    ; created.
+    "device"],
+  attestation: tstr,
+  attestationFormats: [* tstr],
 }
 $$extensionInput //= (
-  devicePubKey: devicePublicKeyInputs,
+  supplementalPubKeys: supplementalPublicKeyInputs,
 )
 </pre>
     <dt data-md>Authenticator extension output
     <dd data-md>
-     <p>The <dfn data-dfn-type="dfn" data-noexport id="device-public-key-attestation-object">device public key attestation object<a class="self-link" href="#device-public-key-attestation-object"></a></dfn>, defined by the <code>attObjForDevicePublicKey</code> type:</p>
+     <p>The supplemental public key attestation objects, defined by the <code>attObjForSupplementalPubKey</code> type:</p>
 <pre>$$extensionOutput //= (
-    devicePubKey: attObjForDevicePublicKey,
-)
+    ; This array of supplemental public keys MUST be ordered
+    ; lexicographically by scope and MUST NOT include more than one element
+    ; with a given scope.
 
-attObjForDevicePublicKey = { ; Note: This object conveys an attested
-                             ; device public key and is analogous to \`attObj\`.
+    supplementalPubKeys: [+ attObjForSupplementalPubKey],
+)
 
-    aaguid:  bstr,  ; Authenticator’s AAGUID (16 bytes fixed-length)
+; This object conveys an attested supplemental public key and is analogous
+; to \`attObj\`.
+attObjForSupplementalPubKey = {
+    aaguid:  bstr,  ; AAGUID (16 bytes fixed-length)
                     ; https://www.w3.org/TR/webauthn/#aaguid
 
-    dpk:     bstr,  ; The Device Public Key (self-describing variable length,
+    spk:     bstr,  ; The public key (self-describing variable length,
                     ; COSE_Key format, CBOR-encoded)).
 
-    ; Whether this key is scoped to the entire device, or a loosely-defined,
-    ; narrower scope called "app". For example, a "device"-scoped key is expected
-    ; to be the same between an app and a browser on the same device, while
-    ; an "app"-scoped key would probably not be.
-    ;
-    ; Whatever the scope, a device key is still specific to a given credential
-    ; and does not provide any ability to link credentials.
-    ;
-    ; Whether device-scoped or not, keys are still device-bound. I.e. an
-    ; app-scoped key does not enjoy lesser protection from extraction.
+    ; See the definition of `scopes` in `supplementalPublicKeyInputs`.
 
-    scope: uint .size 1,  ; A value of 0x00 means "entire device" ("all apps")
-                          ; scope. 0x01 means "per-app" scope.
-                          ; Values other than 0x00 or 0x01 are reserved for future
-                          ; use.
+    scope: "provider" / "device",
 
     ; An authenticator-generated random nonce for inclusion in the attestation
     ; signature. If the authenticator chooses to not generate a nonce, it sets this
@@ -7456,12 +7541,12 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
     ; Attestation statement formats define the \`fmt\` and \`attStmt\` members of
     ; $$attStmtType.
     ; Note that \`fmt\` and \`attStmt\` are top-level members of
-    ; \`attObjForDevicePublicKey\`.
+    ; \`attObjForSupplementalPubKey\`.
     ;
     ; In summary, the \`attStmt\` will (typically) contain:
     ;   (1) a SIGNATURE value calculated (using the attestation private key)
-    ;       over (prefix || aaguid || dpk || nonce) where \`prefix\` is
-    ;       h’64657669636520626f756e64206b6579206174746573746174696f6e20736967
+    ;       over (prefix || aaguid || spk || nonce) where \`prefix\` is
+    ;       h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e
     ;         00ffffffff'.
     ;       (See the attestation calculations section, below, for a discussion
     ;       about the purpose of this \`prefix\` value.)
@@ -7486,258 +7571,293 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
 </pre>
     <dt data-md>Unsigned extension output
     <dd data-md>
-     <p>A CBOR byte string containing a signature generated with the device private key.</p>
+     <p>A non-empty CBOR array of byte strings containing the signatures generated with the supplemental private keys, in the same order as in the authenticator extension output.</p>
+<pre>supplementalPublicKeyOutputs = [+ bstr]
+
+$$unsignedExtensionOutputs //= (
+  supplementalPubKeys: supplementalPublicKeyOutputs,
+)
+</pre>
     <dt data-md>Authenticator extension processing
     <dd data-md>
      <p>For both <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operations:</p>
      <ol>
       <li data-md>
-       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
+       <p>Create or select the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> as usual (see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>, or <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> as appropriate).</p>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible③">backup eligible</a> then terminate these processing steps: this extension only applies to <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑨">multi-device credentials</a>.</p>
+       <p>Let <var>scopes</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of all supplemental public key scopes that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> supports. Update <var>scopes</var> to be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-intersection" id="ref-for-set-intersection">intersection</a> of itself and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes①">scopes</a></code>. If <var>scopes</var> is empty, terminate these processing steps with no extension output.</p>
       <li data-md>
-       <p>If a <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑥">hardware-bound device key pair</a> does not already exist for this {<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">RP ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">userHandle</a>} tuple on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a>, create it using the same public key algorithm as that used by the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑧">user credential</a>'s <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pair</a>, otherwise locate the existing <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑦">device-bound key</a>.</p>
+       <p>Let <var>spks</var> and <var>spkSigs</var> be empty arrays.</p>
       <li data-md>
-       <p>Let <var>attFormat</var> be the chosen <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②④">attestation statement format</a>, and <var>attAaguid</var> be a 16-byte value, based on the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestation" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation①">attestation</a></code> in the extension input:</p>
-       <dl class="switch">
-        <dt data-md>none
-        <dd data-md>
-         <p><var>attFormat</var> is "none" or "self", at the authenticator’s discretion, and <var>attAaguid</var> is 16 zero bytes. (Note that, since the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑧">device-bound key</a> is already exercised during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④④">navigator.credentials.get()</a></code> calls, the proof-of-possession property provided by "self" attestation is superfluous in that context.)</p>
-        <dt data-md>indirect, direct
-        <dd data-md>
-         <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①⓪">AAGUID</a>. (Since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑦">hardware-bound device key pair</a> is specific to a particular authenticator, its attestation can be tied to hardware roots of trust, although they do not have to be. This is in contrast to the associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credential</a>'s attestation, if it is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①⓪">multi-device credential</a>.)</p>
-        <dt data-md>enterprise
-        <dd data-md>
-         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then <var>attFormat</var> is "none" and <var>attAaguid</var> is 16 zero bytes. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①①">AAGUID</a>. (Again, since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑧">hardware-bound device key pair</a> is specific to a particular authenticator, the attestation may be tied to hardware roots of trust.)</p>
-         <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a>.</p>
-       </dl>
-      <li data-md>
-       <p>Let <var>dpk</var> be the newly created or existing <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key④">device public key</a>, in COSE_Key format <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey①⓪">in the same fashion as for the user credential’s credentialPublicKey</a> when the latter is conveyed in <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑦">attested credential data</a>.</p>
-      <li data-md>
-       <p>Let <var>devicePrivateKey</var> be the newly created or existing <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key③">device private key</a>.</p>
-      <li data-md>
-       <p>Let <var>randomNonce</var> be a fresh randomly-generated byte string of 32 bytes maximum length, or a zero length byte string if the authenticator chooses to not generate a nonce.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> <var>randomNonce</var>’s purpose is to randomize the <code>devicePubKey</code> extension’s <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑥">attestation signature</a> value. If this is not done, then the <code>devicePubKey</code> extension’s <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑦">attestation signature</a> value remains constant for all such signatures issued on behalf of this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⓪">user credential</a>, possibly exposing the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a>'s <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">attestation private key</a> to side-channel attacks. The randomness-generation mechanism should be carefully chosen by the authenticator implementer.</p>
+       <p>Sort <var>scopes</var> lexicographically.</p>
       <li data-md>
-       <p>Let the <code>devicePubKey</code> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑦">authenticator extension output</a> value be a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②①">CBOR</a> map as defined by <code>attObjForDevicePublicKey</code> above, with keys and values as follows:</p>
-       <p class="note" role="note"><span class="marker">Note:</span> as with all CBOR structures used in this specification, the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form⑤">CTAP2 canonical CBOR encoding form</a> MUST be used.</p>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑦">For each</a> <var>scope</var> in <var>scopes</var>:</p>
        <ol>
         <li data-md>
-         <p>Let the <code>aaguid</code> key’s value be <var>attAaguid</var>.</p>
+         <p>If a supplemental key with scope <var>scope</var> does not already exist for this {<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">RP ID</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">userHandle</a>} tuple on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a>, create it using the same public key algorithm as that used by the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑤">user credential</a>'s <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pair</a>, otherwise locate the existing supplemental key.</p>
+        <li data-md>
+         <p>Let <var>attFormat</var> be the chosen <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②④">attestation statement format</a>, and <var>attAaguid</var> be a 16-byte value, based on the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation①">attestation</a></code> in the extension input:</p>
+         <dl class="switch">
+          <dt data-md>none
+          <dd data-md>
+           <p><var>attFormat</var> is "none" or "self", at the authenticator’s discretion, and <var>attAaguid</var> is 16 zero bytes. (Note that, since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key">supplemental public key</a> is already exercised during <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">navigator.credentials.create()</a></code> calls, the proof-of-possession property provided by "self" attestation is superfluous in that context.)</p>
+          <dt data-md>indirect, direct
+          <dd data-md>
+           <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator’s</a> AAGUID. (Since the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①">supplemental public key</a>'s scope is different from the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑥">user credential</a>, it will often have a different attestation. For example, the attestation for a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key②">supplemental public key</a> with “device” scope can be tied to hardware roots of trust, although it does not have to be.)</p>
+          <dt data-md>enterprise
+          <dd data-md>
+           <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then follow the steps for <code>direct</code> attestation. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the corresponding <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a>, which MAY be the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator’s</a> AAGUID.</p>
+           <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a>.</p>
+         </dl>
+        <li data-md>
+         <p>Let <var>spk</var> be the newly created or existing supplemental public key, in COSE_Key format <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey①⓪">in the same fashion as for the user credential’s credentialPublicKey</a> when the latter is conveyed in <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑦">attested credential data</a>.</p>
+        <li data-md>
+         <p>Let <var>supplementalPrivateKey</var> be the newly created or existing private key corresponding to <var>spk</var>.</p>
         <li data-md>
-         <p>Let the <code>dpk</code> key’s value be <var>dpk</var>.</p>
+         <p>Let <var>randomNonce</var> be a fresh randomly-generated byte string of 32 bytes maximum length, or a zero length byte string if the authenticator chooses to not generate a nonce.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> <var>randomNonce</var>’s purpose is to randomize the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑥">attestation signature</a> value for <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key③">supplemental public keys</a>. If this is not done, then an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑦">attestation signature</a> value remains constant for all such signatures issued on behalf of this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑦">user credential</a>, possibly exposing the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a>'s <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">attestation private key</a> to side-channel attacks. The randomness-generation mechanism should be carefully chosen by the authenticator implementer.</p>
         <li data-md>
-         <p>Let the <code>nonce</code> key’s value be <var>randomNonce</var>.</p>
+         <p>Let <var>supplementalPubKey</var> be a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②①">CBOR</a> map as defined by <code>attObjForSupplementalPubKey</code> above, with keys and values as follows:</p>
+         <p class="note" role="note"><span class="marker">Note:</span> as with all CBOR structures used in this specification, the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form⑤">CTAP2 canonical CBOR encoding form</a> MUST be used.</p>
+         <ol>
+          <li data-md>
+           <p>Set a key and value for the <code>scope</code> group based on the value of <var>scope</var>.</p>
+          <li data-md>
+           <p>Let the <code>aaguid</code> key’s value be <var>attAaguid</var>.</p>
+          <li data-md>
+           <p>Let the <code>spk</code> key’s value be <var>spk</var>.</p>
+          <li data-md>
+           <p>Let the <code>nonce</code> key’s value be <var>randomNonce</var>.</p>
+          <li data-md>
+           <p>Let the values of the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9①">group socket</a> be the result of generating an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> with the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑦">attestation statement format</a>, <var>attFormat</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>.</p>
+           <p class="note" role="note"><span class="marker">Note:</span> The details of the <code>$$attStmtType</code> values are dependent upon the particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a> format. See <a href="#sctn-attestation-formats">§ 6.5.3 Attestation Statement Formats</a>.</p>
+          <li data-md>
+           <p>If the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9②">group socket</a> contains uniquely identifying information then let <code>epAtt</code> be <code>true</code>. Otherwise omit the <code>epAtt</code> field. (This field can only be <code>true</code> when the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation" id="ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation②">attestation</a></code> field of the extension input is "enterprise" and either the user-agent or the authenticator permits uniquely identifying attestation for the requested RP ID.)</p>
+         </ol>
         <li data-md>
-         <p>Let the <code>scope</code> key have the value zero (0x00) if this is an "entire device" <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑤">device public key</a>. Otherwise, let <code>scope</code> have the value one (0x01), indicating a more narrow per-app scope.</p>
+         <p>Append <var>supplementalPubKey</var> to <var>spks</var>.</p>
         <li data-md>
-         <p>Let the values of the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9①">group socket</a> be the result of generating an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> with the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑦">attestation statement format</a>, <var>attFormat</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The details of the <code>$$attStmtType</code> values are dependent upon the particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a> format. See <a href="#sctn-attestation-formats">§ 6.5.3 Attestation Statement Formats</a>. Since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑨">hardware-bound device key pair</a> is specific to a particular authenticator, its attestation can be tied to hardware roots of trust (although they do not have to be). This is in contrast to the associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①①">user credential</a>'s attestation, if it is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①①">multi-device credential</a>.</p>
+         <p>Let <var>spkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①⓪">assertion signature</a> <a href="#fig-signature">input</a> with <var>supplementalPrivateKey</var>.</p>
+         <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>spkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> knows that <var>spkSig</var> is a fresh signature.</p>
         <li data-md>
-         <p>If the <code>$$attStmtType</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9②">group socket</a> contains uniquely identifying information then let <code>epAtt</code> be <code>true</code>. Otherwise omit the <code>epAtt</code> field. (This field can only be <code>true</code> when the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestation" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation②">attestation</a></code> field of the extension input is "enterprise" and either the user-agent or the authenticator permits uniquely identifying attestation for the requested RP ID.)</p>
+         <p>Append <var>spkSig</var> to <var>spkSigs</var>.</p>
        </ol>
       <li data-md>
-       <p>Let <var>dpkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①⓪">assertion signature</a> <a href="#fig-signature">input</a> with <var>devicePrivateKey</var>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>dpkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> knows that <var>dpkSig</var> is a fresh signature.</p>
+       <p>Let the <code>supplementalPubKeys</code> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑦">authenticator extension output</a> value be the CBOR array <var>spks</var>.</p>
       <li data-md>
-       <p>Output <var>dpkSig</var> as the extension’s <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑦">unsigned extension output</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> <var>dpkSig</var> cannot be included in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑧">authenticator extension output</a> because it is returned inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> and that would imply that the signature signs over itself.</p>
+       <p>Let the CBOR encoding of <var>spkSigs</var> be the extension’s <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑦">unsigned extension output</a>.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> <var>spkSigs</var> cannot be included in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑧">authenticator extension output</a> because it is returned inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> and that would imply that the signature signs over itself.</p>
      </ol>
    </dl>
-   <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-device-publickey-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-device-publickey-attestation-aaguid"></a></h6>
-   <p>The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①②">AAGUID</a> included in the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑥">devicePubKey</a></code> extension output, if non-zero, identifies the make or model of hardware that is storing the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑨">device-bound key</a>. This is distinct from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①③">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑧">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①②">multi-device credential</a>, which likely identifies something broader since such credentials are not bound to a single device. Thus the two AAGUIDs MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
-   <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-device-publickey-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-device-publickey-attestation-calculations"></a></h6>
-   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⓪">device-bound key</a>, the typical value for <code>hash</code> hashes over the attestation signature itself, which is impossible. Also the attestation of a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①①">device-bound key</a> is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
-   <p>Therefore when calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①②">device-bound key</a>, the inputs are:</p>
+   <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-supplemental-public-keys-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-aaguid"></a></h6>
+   <p>Any non-zero <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑤">AAGUID</a>s included in the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑥">supplementalPubKeys</a></code> extension output aid a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> in validating the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a> of the supplemental public key. The interpretation of each AAGUID depends on the scope of the corresponding key. Some or all may differ from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑧">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①⓪">multi-device credential</a>. Thus the AAGUID of a <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key④">supplemental public key</a> MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
+   <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-supplemental-public-keys-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-supplemental-public-keys-attestation-calculations"></a></h6>
+   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a supplemental public key, the typical value for <code>authData</code> contains the attestation signature itself, which is impossible. Also the attestation of a supplemental public key is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
+   <p>Therefore when calculating an attestation for a supplemental public key, the inputs are:</p>
    <ul>
     <li data-md>
-     <p>For <code>authData</code>, substitute the concatenation of the byte string h’64657669636520626f756e64206b6579206174746573746174696f6e2073696700ffffffff' and the value of <var>aaguid</var> from the extension output.</p>
+     <p>For <code>authData</code>, substitute the concatenation of the byte string h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e00ffffffff' and the value of <var>aaguid</var> from the extension output.</p>
     <li data-md>
-     <p>For <code>hash</code>, substitute the concatenation of the <var>dpk</var> and <var>nonce</var> fields from the extension output. (The nonce MAY be empty.)</p>
+     <p>For <code>hash</code>, substitute the concatenation of the <var>spk</var> and <var>nonce</var> fields from the extension output. (The nonce MAY be empty.)</p>
    </ul>
-   <p>The attestation signature is thus typically calculated over the bytes of <code>(h’64657669636520626f756e64206b6579206174746573746174696f6e2073696700ffffffff' || <var>aaguid</var> || <var>dpk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①③">device-bound key</a> can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>.</p>
-   <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>dpkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key④">device private key</a>.</p>
-   <h5 class="heading settled" data-level="10.2.2.3" id="sctn-device-publickey-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>devicePubKey</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-device-publickey-extension-verification"></a></h5>
-   <p>Verifying the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑦">devicePubKey</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> whenever a <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑥">device public key</a> is returned within the extension output.</p>
-   <p>The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑧">devicePubKey</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential records</a>:</p>
+   <p>The attestation signature is thus typically calculated over the bytes of <code>(h’737570706c656d656e74616c5075624b657973206174746573746174696f6e2e00ffffffff' || <var>aaguid</var> || <var>spk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a supplemental public key can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑧">user credential</a>.</p>
+   <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>spkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the supplemental private key.</p>
+   <h5 class="heading settled" data-level="10.2.2.3" id="sctn-supplemental-public-keys-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>supplementalPubKeys</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification"></a></h5>
+   <p>Verifying the <code><a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑦">supplementalPubKeys</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> whenever a supplemental public key is returned within the extension output.</p>
+   <p>The <a data-link-type="dfn" href="#supplementalpubkeys" id="ref-for-supplementalpubkeys⑧">supplementalPubKeys</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①③">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>:</p>
    <dl>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-devicepubkeys">devicePubKeys</dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</dfn>
     <dd data-md>
-     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑦">set</a> of <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record">device-bound key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a>.</p>
-     <p>A <dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-device-bound-key-record">device-bound key record</dfn> is an abstract representation of a registered <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①④">device-bound key</a>.
-It is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑥">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①③">items</a>:</p>
+     <p>An initially <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a> of <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record">supplemental public key records</a> associated with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">public key credential source</a>.</p>
+     <p>A <dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-supplemental-public-key-record">supplemental public key record</dfn> is an abstract representation of a registered supplemental public key.
+It is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑥">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①④">items</a>:</p>
      <dl>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="devicePubKey record" data-dfn-type="abstract-op" data-export id="abstract-opdef-devicepubkey-record-aaguid">aaguid</dfn>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-aaguid">aaguid</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①④">AAGUID</a> of the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⑤">device-bound key</a>'s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>.
-This MAY be different from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①⑤">AAGUID</a> in the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject③">attestationObject</a>, if any, of the containing <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①④">credential record</a>.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="devicePubKey record" data-dfn-type="abstract-op" data-export id="abstract-opdef-devicepubkey-record-dpk">dpk</dfn>
+       <p>The <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑥">AAGUID</a> included with the supplemental public key.
+This MAY be different from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑨">aaguid</a> in the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject③">attestationObject</a>, if any, of the containing <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-spk">spk</dfn>
       <dd data-md>
-       <p>The public key portion of the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⑥">device-bound key</a>.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="devicePubKey record" data-dfn-type="abstract-op" data-export id="abstract-opdef-devicepubkey-record-scope">scope</dfn>
+       <p>The public key portion of the supplemental public key.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-scope">scope</dfn>
       <dd data-md>
-       <p>The scope of the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⑦">device-bound key</a>. See <a href="#sctn-device-publickey-extension-definition">§ 10.2.2.2 Extension Definition</a> for details.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="devicePubKey record" data-dfn-type="abstract-op" data-export id="abstract-opdef-devicepubkey-record-fmt">fmt</dfn>
+       <p>The scope of the supplemental public key. See <a href="#sctn-supplemental-public-keys-extension-definition">§ 10.2.2.2 Extension Definition</a> for details.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-fmt">fmt</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑧">attestation statement format</a> of the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⑧">device-bound key</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑤">attestation statement</a>.</p>
-      <dt data-md><dfn class="dfn-paneled" data-dfn-for="devicePubKey record" data-dfn-type="abstract-op" data-export id="abstract-opdef-devicepubkey-record-attstmt">attStmt</dfn>
+       <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑧">attestation statement format</a> of the supplemental public key’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑥">attestation statement</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="supplementalPubKeys record" data-dfn-type="abstract-op" data-export id="abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⑨">device-bound key</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑥">attestation statement</a>.</p>
+       <p>The supplemental public key’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>.</p>
      </dl>
    </dl>
-   <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
-then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-supplemental-public-keys-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-create"></a></h6>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
+then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
-     <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature">signature</a></code> field.</p>
-    <li data-md>
-     <p>Let <var>attObjForDevicePublicKey</var> be the value of the <code>devicePubKey</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑨">authenticator extension output</a> from <var>authData</var>.</p>
-    <li data-md>
-     <p>Extract the contained fields from <var>attObjForDevicePublicKey</var>: <var>aaguid</var>, <var>dpk</var>, <var>scope</var>, <var>nonce</var>, <var>fmt</var>, <var>attStmt</var>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForDevicePublicKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of the top-level <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②④">attestation object</a>.</p>
+     <p>Verify that the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys">supplementalPubKeys</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures" id="ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures">signatures</a></code> field. Let <var>signatures</var> be the value of that field.</p>
     <li data-md>
-     <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature①">signature</a></code> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑦">device public key</a> <var>dpk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a>.)</p>
+     <p>Let <var>attObjsForSupplementalPublicKey</var> be the value of the <code>supplementalPubKeys</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑨">authenticator extension output</a> from <var>authData</var>.</p>
     <li data-md>
-     <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
+     <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>attObjsForSupplementalPublicKey</var> is not equal to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size②">size</a> of <var>signatures</var> then abort the registration process with an error.</p>
     <li data-md>
-     <p>Create a new <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record①">device-bound key record</a> with the contents:</p>
-     <dl>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-aaguid" id="ref-for-abstract-opdef-devicepubkey-record-aaguid">aaguid</a>
-      <dd data-md>
-       <p>The value of <var>aaguid</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk">dpk</a>
-      <dd data-md>
-       <p>The value of <var>dpk</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-scope" id="ref-for-abstract-opdef-devicepubkey-record-scope">scope</a>
-      <dd data-md>
-       <p>The value of <var>scope</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-fmt" id="ref-for-abstract-opdef-devicepubkey-record-fmt">fmt</a>
-      <dd data-md>
-       <p>The value of <var>fmt</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt">attStmt</a>
-      <dd data-md>
-       <p>The value of <var>attStmt</var>.</p>
-     </dl>
-     <p>In <a href="#reg-ceremony-store-credential-record">step 26</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-add this <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record②">device-bound key record</a> to the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys">devicePubKeys</a> member of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑤">credential record</a>.</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">Iterate</a> over the indices of <var>attObjsForSupplementalPublicKey</var> (which, after the check in the previous step, must also be the indices of <var>signatures</var>). Then, for each (<var>attObjForSupplementalPubKey</var>, <var>signature</var>) from the two lists:</p>
+     <ol>
+      <li data-md>
+       <p>Extract the contained fields from <var>attObjForSupplementalPubKey</var>: <var>aaguid</var>, <var>spk</var>, <var>nonce</var>, <var>fmt</var> and <var>attStmt</var>. Also let <var>scope</var> reflect the scope, specified by the member of the <code>scope</code> group that is present.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForSupplementalPubKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of the top-level <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a>.</p>
+      <li data-md>
+       <p>Verify that <var>signature</var> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑤">supplemental public key</a> <var>spk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①⑨">user credential</a>.)</p>
+      <li data-md>
+       <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑦">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
+      <li data-md>
+       <p>Create a new <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record①">supplemental public key record</a> with the contents:</p>
+       <dl>
+        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid">aaguid</a>
+        <dd data-md>
+         <p>The value of <var>aaguid</var>.</p>
+        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk">spk</a>
+        <dd data-md>
+         <p>The value of <var>spk</var>.</p>
+        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope">scope</a>
+        <dd data-md>
+         <p>The value of <var>scope</var>.</p>
+        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-fmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-fmt">fmt</a>
+        <dd data-md>
+         <p>The value of <var>fmt</var>.</p>
+        <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</a>
+        <dd data-md>
+         <p>The value of <var>attStmt</var>.</p>
+       </dl>
+       <p>In <a href="#reg-ceremony-store-credential-record">step 26</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
+add this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record②">supplemental public key record</a> to the <a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys">supplementalPubKeys</a> member of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>.</p>
+     </ol>
    </ol>
-   <p>See also <a href="#sctn-device-publickey-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
-   <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
-then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
+   <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-supplemental-public-keys-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-supplemental-public-keys-extension-verification-get"></a></h6>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> requested the <code>supplementalPubKeys</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④④">navigator.credentials.get()</a></code> call,
+then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> policy may specify whether a response without a <code>supplementalPubKeys</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
-     <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey①">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature②">signature</a></code> field.</p>
+     <p>Let <var>recognizedSpks</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>.</p>
     <li data-md>
-     <p>Let <var>attObjForDevicePublicKey</var> be the value of the <code>devicePubKey</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output②⓪">authenticator extension output</a> from <var>authData</var>.</p>
+     <p>Verify that the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys" id="ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys①">supplementalPubKeys</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures" id="ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures①">signatures</a></code> field. Let <var>signatures</var> be the value of that field.</p>
     <li data-md>
-     <p>Extract the contained fields from <var>attObjForDevicePublicKey</var>: <var>aaguid</var>, <var>dpk</var>, <var>scope</var>, <var>nonce</var>, <var>fmt</var>, <var>attStmt</var>.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForDevicePublicKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a>.</p>
+     <p>Let <var>attObjsForSupplementalPubKeys</var> be the value of the <code>supplementalPubKeys</code> member of the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output②⓪">authenticator extension output</a> from <var>authData</var>.</p>
     <li data-md>
-     <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature③">signature</a></code> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①③">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑧">device public key</a> <var>dpk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a>.)</p>
+     <p>If the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size③">size</a> of <var>attObjsForSupplementalPubKeys</var> is not equal to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size④">size</a> of <var>signatures</var> then abort the authentication process with an error.</p>
     <li data-md>
-     <p>Let <var>matchedDpkRecords</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys①">devicePubKeys</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②②">Iterate</a> over the indices of <var>attObjsForSupplementalPubKeys</var> (which, after the check in the previous step, must also be the indices of <var>signatures</var>). Then, for each (<var>attObjForSupplementalPubKey</var>, <var>signature</var>) from the two lists:</p>
      <ol>
       <li data-md>
-       <p>If <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-aaguid" id="ref-for-abstract-opdef-devicepubkey-record-aaguid①">aaguid</a> equals <var>aaguid</var>, <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk①">dpk</a> equals <var>dpk</var>,
-  and <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-scope" id="ref-for-abstract-opdef-devicepubkey-record-scope①">scope</a> equals <var>scope</var>:</p>
+       <p>Extract the contained fields from <var>attObjForSupplementalPubKey</var>: <var>aaguid</var>, <var>spk</var>, <var>nonce</var>, <var>fmt</var>, <var>attStmt</var>. Also let <var>scope</var> reflect the scope, specified by the member of the <code>scope</code> group that is present.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The latter <var>attObjForSupplementalPubKey</var> fields are referenced exclusively in the below steps and are not to be confused with other fields with the same names in other portions of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑧">authenticator data</a>.</p>
+      <li data-md>
+       <p>Verify that <var>signature</var> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①③">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑥">supplemental public key</a> <var>spk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②⓪">user credential</a>.)</p>
+      <li data-md>
+       <p>Let <var>matchedSpkRecords</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①⓪">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②③">For each</a> <var>spkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys①">supplementalPubKeys</a>:</p>
        <ol>
         <li data-md>
-         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑥">Append</a> <var>dpkRecord</var> to <var>matchedDpkRecords</var>.</p>
+         <p>If <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid①">aaguid</a> equals <var>aaguid</var>, <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk①">spk</a> equals <var>spk</var>,
+  and <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope①">scope</a> equals <var>scope</var>:</p>
+         <ol>
+          <li data-md>
+           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑥">Append</a> <var>spkRecord</var> to <var>matchedSpkRecords</var>.</p>
+         </ol>
        </ol>
-     </ol>
-    <li data-md>
-     <p>If <var>matchedDpkRecords</var></p>
-     <dl class="switch">
-      <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> greater than one:
-      <dd data-md>
-       <p>Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.</p>
-      <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size②">size</a> equal to one:
-      <dd data-md>
-       <p>This is likely a known device.</p>
-       <p>If <var>fmt</var>’s value is "none" then there is no attestation signature to verify and this is a known <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑨">device public key</a> with a valid signature and thus a known device. Terminate these verification steps.</p>
-       <p>Otherwise, let <var>dpkRecord</var> be <var>matchedDpkRecords</var>[0]. If the <var>attStmt</var> in <var>attObjForDevicePublicKey</var>:</p>
+      <li data-md>
+       <p>If <var>matchedSpkRecords</var></p>
        <dl class="switch">
-        <dt data-md>equals <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt①">attStmt</a> by binary equality:
+        <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size⑤">size</a> greater than one:
         <dd data-md>
-         <p>This is a known <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①⓪">device public key</a> with a valid signature and valid attestation and thus a known device. Terminate these verification steps.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
-        <dt data-md>does not equal <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt②">attStmt</a> by binary equality:
+         <p>Some form of error has occurred: <var>credentialRecord</var> invariants have been broken. Terminate these verification steps.</p>
+        <dt data-md>has <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size⑥">size</a> equal to one:
         <dd data-md>
-         <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-         <p>If the result is:</p>
+         <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑦">supplemental public key</a></p>
+         <p>If <var>fmt</var>’s value is "none" then there is no attestation signature to verify and this is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑧">supplemental public key</a> with a valid signature. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
+         <p>Otherwise, let <var>spkRecord</var> be <var>matchedSpkRecords</var>[0]. If the <var>attStmt</var> in <var>attObjForSupplementalPubKey</var>:</p>
          <dl class="switch">
-          <dt data-md>successful
+          <dt data-md>equals <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt①">attStmt</a> by binary equality:
           <dd data-md>
-           <p>This is a known <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①①">device public key</a> with a valid signature and valid attestation and thus a known device. Terminate these verification steps.</p>
-          <dt data-md>unsuccessful
+           <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key⑨">supplemental public key</a> with a valid signature and valid attestation. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
+           <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
+          <dt data-md>does not equal <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt②">attStmt</a> by binary equality:
           <dd data-md>
-           <p>Some form of error has occurred. It is indeterminate whether this is a known device. Terminate these verification steps.</p>
+           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑧">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+           <p>If the result is:</p>
+           <dl class="switch">
+            <dt data-md>successful
+            <dd data-md>
+             <p>This is a known <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①⓪">supplemental public key</a> with a valid signature and valid attestation. Append <var>spkRecord</var> to <var>recognizedSpks</var> and continue to the next iteration, if any.</p>
+            <dt data-md>unsuccessful
+            <dd data-md>
+             <p>Some form of error has occurred. It is indeterminate whether this is a valid <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①①">supplemental public key</a>. Either terminate these verification steps with an error or continue to the next iteration, if any, to ignore this key.</p>
+           </dl>
          </dl>
-       </dl>
-      <dt data-md>is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑧">empty</a>:
-      <dd data-md>
-       <p>This is possibly a new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①②">device public key</a> signifying a new device.</p>
-       <ol>
-        <li data-md>
-         <p>Let <var>matchedDpkKeys</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑨">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys②">devicePubKeys</a>:</p>
+        <dt data-md>is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑨">empty</a>:
+        <dd data-md>
+         <p>This is possibly a new <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①②">supplemental public key</a>.</p>
          <ol>
           <li data-md>
-           <p>If <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk②">dpk</a> equals <var>dpk</var>:</p>
+           <p>Let <var>matchedSpkKeys</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①⓪">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①①">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②④">For each</a> <var>spkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys②">supplementalPubKeys</a>:</p>
            <ol>
             <li data-md>
-             <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑦">Append</a> <var>dpkRecord</var> to <var>matchedDpkKeys</var>.</p>
+             <p>If <var>spkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk②">spk</a> equals <var>spk</var>:</p>
+             <ol>
+              <li data-md>
+               <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑦">Append</a> <var>spkRecord</var> to <var>matchedSpkKeys</var>.</p>
+             </ol>
            </ol>
-         </ol>
-        <li data-md>
-         <p>If <var>matchedDpkKeys</var> is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①⓪">empty</a>:</p>
-         <dl class="switch">
-          <dt data-md>If <var>fmt</var>’s value is "none":
-          <dd data-md>
-           <p>There is no attestation signature to verify and this is a new device. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a> and then terminate these verification steps.</p>
-          <dt data-md>Otherwise:
-          <dd data-md>
-           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
-           <p>If the result is:</p>
+          <li data-md>
+           <p>If <var>matchedSpkKeys</var> is <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a>:</p>
            <dl class="switch">
-            <dt data-md>successful
+            <dt data-md>If <var>fmt</var>’s value is "none":
             <dd data-md>
-             <p>This is a new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①③">device public key</a> signifying a new device. <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record①">Create a new device-bound key record</a>, then terminate these verification steps.</p>
-            <dt data-md>unsuccessful
+             <p>There is no attestation signature to verify and this is a new supplemental key. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a> and then continue to the next iteration, if any.</p>
+            <dt data-md>Otherwise:
             <dd data-md>
-             <p>Some form of error has occurred. It is indeterminate whether this is a valid new device. Terminate these verification steps.</p>
+             <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑨">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-supplemental-public-keys-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+             <p>If the result is:</p>
+             <dl class="switch">
+              <dt data-md>successful
+              <dd data-md>
+               <p>This is a new <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①③">supplemental public key</a>. <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-supplemental-public-key-record" id="ref-for-abstract-opdef-create-a-new-supplemental-public-key-record①">Create a new supplemental public key record</a> then continue to the next iteration, if any.</p>
+              <dt data-md>unsuccessful
+              <dd data-md>
+               <p>Some form of error has occurred and a supplemental public key record cannot be created. Either terminate these verification steps with an error or continue to the next iteration, if any, to ignore this supplemental public key.</p>
+             </dl>
            </dl>
-         </dl>
-        <li data-md>
-         <p>Otherwise there is some form of error: we recieved a known <var>dpk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> has stored along with that <var>dpk</var> value. Terminate these verification steps.</p>
-       </ol>
-     </dl>
+          <li data-md>
+           <p>Otherwise there is some form of error: we recieved a known <var>spk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> has stored along with that <var>spk</var> value. Terminate these verification steps.</p>
+         </ol>
+       </dl>
+     </ol>
    </ol>
-   <p>See also <a href="#sctn-device-publickey-extension-usage">§ 10.2.2.1 Relying Party Usage</a>.</p>
-   <p>To <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</dfn>, perform the following steps:</p>
+   <p>At the end of these steps, <var>recognizedSpks</var> contains zero or more <a data-link-type="dfn" href="#supplemental-public-key" id="ref-for-supplemental-public-key①④">supplemental public keys</a> that were previously known for this <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②①">user credential</a>. These keys make claims about the continuity of certain factors between this authentication attempt and previous ones. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> should judge those claims in light of the attestations provided, if any, and evaluate the risk of this authentication in light of this information.</p>
+   <p>See also <a href="#sctn-supplemental-public-keys-extension-usage">§ 10.2.2.1 Relying Party Usage</a>.</p>
+   <p>To <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</dfn>, perform the following steps:</p>
    <ol>
     <li data-md>
-     <p>Create a new <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record③">device-bound key record</a> with the contents:</p>
+     <p>Create a new <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record③">supplemental public key record</a> with the contents:</p>
      <dl>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-aaguid" id="ref-for-abstract-opdef-devicepubkey-record-aaguid②">aaguid</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-aaguid" id="ref-for-abstract-opdef-supplementalpubkeys-record-aaguid②">aaguid</a>
       <dd data-md>
        <p>The value of <var>aaguid</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk③">dpk</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-spk" id="ref-for-abstract-opdef-supplementalpubkeys-record-spk③">spk</a>
       <dd data-md>
-       <p>The value of <var>dpk</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-scope" id="ref-for-abstract-opdef-devicepubkey-record-scope②">scope</a>
+       <p>The value of <var>spk</var>.</p>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-scope" id="ref-for-abstract-opdef-supplementalpubkeys-record-scope②">scope</a>
       <dd data-md>
        <p>The value of <var>scope</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-fmt" id="ref-for-abstract-opdef-devicepubkey-record-fmt①">fmt</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-fmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-fmt①">fmt</a>
       <dd data-md>
        <p>The value of <var>fmt</var>.</p>
-      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt③">attStmt</a>
+      <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-supplementalpubkeys-record-attstmt" id="ref-for-abstract-opdef-supplementalpubkeys-record-attstmt③">attStmt</a>
       <dd data-md>
        <p>The value of <var>attStmt</var>.</p>
      </dl>
-     <p>In <a href="#authn-ceremony-update-credential-record">step 22</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑧">append</a> this <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record④">device-bound key record</a> to <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys③">devicePubKeys</a>.</p>
+     <p>In <a href="#authn-ceremony-update-credential-record">step 22</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑧">append</a> this <a data-link-type="dfn" href="#credential-record-supplemental-public-key-record" id="ref-for-credential-record-supplemental-public-key-record④">supplemental public key record</a> to <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-supplementalpubkeys" id="ref-for-abstract-opdef-credential-record-supplementalpubkeys③">supplementalPubKeys</a>.</p>
    </ol>
    <h2 class="heading settled" data-level="11" id="sctn-automation"><span class="secno">11. </span><span class="content">User Agent Automation</span><a class="self-link" href="#sctn-automation"></a></h2>
    <p>For the purposes of user agent automation and <a data-link-type="dfn" href="#web-application" id="ref-for-web-application④">web application</a> testing, this document defines a number of <a data-link-type="biblio" href="#biblio-webdriver" title="WebDriver">[WebDriver]</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands">extension commands</a>.</p>
@@ -7804,7 +7924,7 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
        <td>credBlob Extension Support
        <td><code>"webauthn:extension:credBlob"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.
     </table>
    </figure>
    <p>When <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-validate-capabilities" id="ref-for-dfn-validate-capabilities①">validating capabilities</a>, the extension-specific substeps to validate an <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities">authenticator extension capability</a> <code>key</code> with <code>value</code> are the following:</p>
@@ -7832,7 +7952,7 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p>An non-null string made using up to 48 characters from the <code>unreserved</code> production defined in Appendix A of <a data-link-type="biblio" href="#biblio-rfc3986" title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</a> that uniquely identifies the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑤">Virtual Authenticator</a>.</p>
     <dt data-md><var>protocol</var>
     <dd data-md>
-     <p>The protocol the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑥">Virtual Authenticator</a> speaks: one of <code>"ctap1/u2f"</code>, <code>"ctap2"</code> or <code>"ctap2_1"</code> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
+     <p>The protocol the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑥">Virtual Authenticator</a> speaks: one of <code>"ctap1/u2f"</code>, <code>"ctap2"</code> or <code>"ctap2_1"</code> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
     <dt data-md><var>transport</var>
     <dd data-md>
      <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑦">AuthenticatorTransport</a></code> simulated. If the <var>transport</var> is set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal③">internal</a></code>, the
@@ -8263,7 +8383,7 @@ <h3 class="heading settled" data-level="12.1" id="sctn-att-fmt-reg-update"><span
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: packed</p>
     <li data-md>
-     <p>Description: The "packed" attestation statement format is a WebAuthn-optimized format for <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑥">attestation</a>. It uses a very
+     <p>Description: The "packed" attestation statement format is a WebAuthn-optimized format for <a data-link-type="dfn" href="#attestation" id="ref-for-attestation③⓪">attestation</a>. It uses a very
 compact but still extensible encoding method. This format is implementable by authenticators with limited resources (e.g.,
 secure elements).</p>
     <li data-md>
@@ -8318,14 +8438,14 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: uvm</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication extension</a> enables use of a user verification method.
+     <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②④">authentication extension</a> enables use of a user verification method.
 The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a> which user verification methods (factors) were
 used for the WebAuthn operation.</p>
     <li data-md>
@@ -8344,56 +8464,56 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
      <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑤">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⑤">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
-The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
+The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
 The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Parties</a> as to their provenance.</p>
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation③①">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
-Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> security characteristics.</p>
+Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> is not signed.
-This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑥">assertion</a>), and thus the interaction would end in an error.</p>
+This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a> returns
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
 For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
-must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a>.
-This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> that can be invoked remotely —
-even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
+must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>.
+This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> that can be invoked remotely —
+even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> has to trust the third party to
-enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a>.
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> has to trust the third party to
+enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
-and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
-   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
+and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
+   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span class="secno">13.3.1. </span><span class="content">Attestation Certificate Hierarchy</span><a class="self-link" href="#sctn-cert-hierarchy"></a></h4>
    <p>A 3-tier hierarchy for attestation certificates is RECOMMENDED (i.e., Attestation Root, Attestation Issuing CA, Attestation
 Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
@@ -8402,137 +8522,139 @@ <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span c
 SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥⓪">authenticator data</a>.</p>
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①②">WebAuthn Authenticator</a> manufacturer that
-has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
+has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
 intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
    <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> can optionally
-enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticators</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> can optionally
+enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
-Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
+     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
+Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
-methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
+methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
 to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①③">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
+   <p>Challenges SHOULD be valid for a duration similar to the
+upper limit of the <a data-link-type="dfn" href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout" id="ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout②">recommended range and default for a WebAuthn ceremony timeout</a>.</p>
    <p>In order to prevent replay attacks, the challenges MUST contain enough entropy to make guessing them infeasible. Challenges SHOULD
 therefore be at least 16 bytes long.</p>
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
-However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a> was generated
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
-to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑥">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
+   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a>, if present,
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> qualities.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
+However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a>, on its own,
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑥">attestation object</a> was generated
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑦">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a>: unscathed
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> reports
-a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> model than the user expects.</p>
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a> reports
+a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> also
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> also
 un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a> in order to un-register
-related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> was performed after revocation of such certificates.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
+related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
-different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticators</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
+different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> argument risks leaking information
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
-For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
+For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a> by providing only a username,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>.
-The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑦">assertion</a> for successful authentication,
+The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①④">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
 and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a>.</p>
     <li data-md>
      <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a>.
 For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
    </ul>
    <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><span class="secno">13.4.9. </span><span class="content">Validating the origin of a credential</span><a class="self-link" href="#sctn-validating-origin"></a></h4>
    <p>When <a href="#rp-op-registering-a-new-credential-step-origin">registering a credential</a> and
 when <a href="#rp-op-verifying-assertion-step-origin">verifying an assertion</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
-   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
+   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
 as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credentials</a>.
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of <a data-link-type="dfn">WebAuthn credentials</a> prevents their use on domains
 outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤②">RP ID</a> they were registered for,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a>'s origin validation serves as an additional layer of protection
-in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>'s origin validation serves as an additional layer of protection
+in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
-   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a>.
+   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8547,11 +8669,11 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
      <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.</p>
     <li data-md>
      <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑧">origin</a></code> to be an operating system dependent
-identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
+identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
    <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> MUST validate that its value is expected.
-This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> MUST validate that its value is expected.
+This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8569,7 +8691,7 @@ <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><sp
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -8581,72 +8703,72 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
      <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> depending on the implementation.</p>
     <li data-md>
-     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticator</a>.</p>
+     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticators</a>, e.g., product names.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑥">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticator</a>.</p>
     <li data-md>
-     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a>.</p>
+     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>, e.g., serial numbers.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
    <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Parties</a>.</p>
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑦">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①①②">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①①③">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Parties</a> thus cannot correlate users between their
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑧">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑧">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>.</p>
-   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①④">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑤">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a>.</p>
+   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
 or link various online identities of the same user together.
 This can be mitigated in several ways, including:</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticators</a> in batches
-where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticators</a> in batches
+where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②①">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
 This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">private key</a> is compromised.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
 while also minimizing the batch size in order to limit the number of affected users
 in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> is compromised.</p>
-     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
+     <p><a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
 sufficiently large groups. This may serve as guidance about suitable batch sizes.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> can ship with a
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑧">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> can ship with a
 main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑨">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificate</a>),
 and combined with a cloud-operated <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑦">Anonymization CA</a>,
 can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">attestation certificates</a>.</p>
@@ -8656,84 +8778,84 @@ <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><s
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication
-ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> has been
-performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> SHOULD NOT store personally identifying information.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①①⑤">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①①⑥">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑧">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication
+ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> has been
+performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> SHOULD NOT store personally identifying information.</p>
    <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
-   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①②">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a>'s enrolled user(s).</p>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①⑦">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a>:</p>
    <ul>
     <li data-md>
-     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticators</a> are present.</p>
+     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticators</a> are present.</p>
     <li data-md>
-     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> is excluded.</p>
+     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> could identify the user by probing for
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
 timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> could identify the user by probing
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
-one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> parameter is
+failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a>. In this
+case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> parameter is
 available to the user.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
-and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a> may implement to mitigate or prevent information
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Party</a> responds with a failure, but then
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤②">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤④">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
 send a message to this address, containing an unpredictable one-time code and instructions for how to use it to
 proceed with the ceremony. Display the same message to the user in the web interface regardless of the contents of the
 sent e-mail and whether or not this e-mail address was already registered.</p>
@@ -8743,23 +8865,23 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> matching the provided username, continue the
-ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑥">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①⑤">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
-       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>;
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> matching the provided username, continue the
+ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①⑤">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
+       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑤">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
-    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> member could therefore be populated with pseudo-random values
+    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse①①">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse①①">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
 before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
@@ -8767,33 +8889,41 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑥">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①③">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Parties</a>,
-so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> and their lengths
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument risks leaking personally identifying information,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑦">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑧">Relying Parties</a>,
+so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> could for example:</p>
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a>.</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⑨">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑤">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a>.</p>
     <li data-md>
      <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
-so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument is not needed.</p>
+so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑦">allowCredentials</a></code> argument is not needed.</p>
    </ul>
    <p>If the above prevention measures are not available,
-i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> needs to be exposed given only a username,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑥⓪">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑨">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑥①">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑥②">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
+   <ul>
+    <li data-md>
+     <p>Recommended range: 300000 milliseconds to 600000 milliseconds.</p>
+    <li data-md>
+     <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
+   </ul>
    <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span class="secno">16. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
     We thank the following people for their reviews of, and contributions to, this specification:
 Yuriy Ackermann,
@@ -8813,12 +8943,11 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
 Kimberly Paulhamus,
 Adam Powers,
 Yaron Sheffer,
-Ki-Eun Shin,
 Anne van Kesteren,
 Johan Verrept,
 and
 Boris Zbarsky. 
-   <p>Thanks to Adam Powers for creating the overall <a data-link-type="dfn" href="#registration" id="ref-for-registration③⓪">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑨">authentication</a> flow diagrams
+   <p>Thanks to Adam Powers for creating the overall <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑧">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑨">authentication</a> flow diagrams
 (<a href="#fig-registration">Figure 1</a> and <a href="#fig-authentication">Figure 2</a>).</p>
    <p>We thank
 Anthony Nadalin,
@@ -8837,10 +8966,11 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
   <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
   <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="content">Terms defined by this specification</span><a class="self-link" href="#index-defined-here"></a></h3>
   <ul class="index">
+   <li><a href="#aaguid">AAGUID</a><span>, in § 6</span>
    <li>
     aaguid
     <ul>
-     <li><a href="#abstract-opdef-devicepubkey-record-aaguid">abstract-op for devicePubKey record</a><span>, in § 10.2.2.3</span>
+     <li><a href="#abstract-opdef-supplementalpubkeys-record-aaguid">abstract-op for supplementalPubKeys record</a><span>, in § 10.2.2.3</span>
      <li><a href="#authdata-attestedcredentialdata-aaguid">dfn for authData/attestedCredentialData</a><span>, in § 6.5.2</span>
     </ul>
    <li><a href="#add-credential">Add Credential</a><span>, in § 11.5</span>
@@ -8877,7 +9007,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     attestation
     <ul>
-     <li><a href="#dom-authenticationextensionsdevicepublickeyinputs-attestation">dict-member for AuthenticationExtensionsDevicePublicKeyInputs</a><span>, in § 10.2.2.2</span>
+     <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation">dict-member for AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-publickeycredentialcreationoptions-attestation">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
      <li><a href="#dom-publickeycredentialcreationoptionsjson-attestation">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-attestation">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
@@ -8892,7 +9022,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     attestationFormats
     <ul>
-     <li><a href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats">dict-member for AuthenticationExtensionsDevicePublicKeyInputs</a><span>, in § 10.2.2.2</span>
+     <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats">dict-member for AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-publickeycredentialcreationoptions-attestationformats">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
      <li><a href="#dom-publickeycredentialcreationoptionsjson-attestationformats">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-attestationformats">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
@@ -8920,7 +9050,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#attestation-type">attestation type</a><span>, in § 6.5</span>
    <li><a href="#attested-credential-data">Attested credential data</a><span>, in § 6.5.2</span>
    <li><a href="#authdata-attestedcredentialdata">attestedCredentialData</a><span>, in § 6.1</span>
-   <li><a href="#abstract-opdef-devicepubkey-record-attstmt">attStmt</a><span>, in § 10.2.2.3</span>
+   <li><a href="#abstract-opdef-supplementalpubkeys-record-attstmt">attStmt</a><span>, in § 10.2.2.3</span>
    <li><a href="#authentication">Authentication</a><span>, in § 4</span>
    <li><a href="#authentication-assertion">Authentication Assertion</a><span>, in § 4</span>
    <li><a href="#authentication-ceremony">Authentication Ceremony</a><span>, in § 4</span>
@@ -8929,13 +9059,13 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a><span>, in § 5.1.9</span>
    <li><a href="#dictdef-authenticationextensionsclientoutputs">AuthenticationExtensionsClientOutputs</a><span>, in § 5.7.2</span>
    <li><a href="#dictdef-authenticationextensionsclientoutputsjson">AuthenticationExtensionsClientOutputsJSON</a><span>, in § 5.1</span>
-   <li><a href="#dictdef-authenticationextensionsdevicepublickeyinputs">AuthenticationExtensionsDevicePublicKeyInputs</a><span>, in § 10.2.2.2</span>
-   <li><a href="#dictdef-authenticationextensionsdevicepublickeyoutputs">AuthenticationExtensionsDevicePublicKeyOutputs</a><span>, in § 10.2.2.2</span>
    <li><a href="#dictdef-authenticationextensionslargeblobinputs">AuthenticationExtensionsLargeBlobInputs</a><span>, in § 10.1.5</span>
    <li><a href="#dictdef-authenticationextensionslargebloboutputs">AuthenticationExtensionsLargeBlobOutputs</a><span>, in § 10.1.5</span>
    <li><a href="#dictdef-authenticationextensionsprfinputs">AuthenticationExtensionsPRFInputs</a><span>, in § 10.1.4</span>
    <li><a href="#dictdef-authenticationextensionsprfoutputs">AuthenticationExtensionsPRFOutputs</a><span>, in § 10.1.4</span>
    <li><a href="#dictdef-authenticationextensionsprfvalues">AuthenticationExtensionsPRFValues</a><span>, in § 10.1.4</span>
+   <li><a href="#dictdef-authenticationextensionssupplementalpubkeysinputs">AuthenticationExtensionsSupplementalPubKeysInputs</a><span>, in § 10.2.2.2</span>
+   <li><a href="#dictdef-authenticationextensionssupplementalpubkeysoutputs">AuthenticationExtensionsSupplementalPubKeysOutputs</a><span>, in § 10.2.2.2</span>
    <li><a href="#authentication-factor-capability">Authentication Factor Capability</a><span>, in § 6.2.3</span>
    <li><a href="#dictdef-authenticationresponsejson">AuthenticationResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#authenticator">Authenticator</a><span>, in § 4</span>
@@ -8966,6 +9096,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for the attestation</a><span>, in § 6.5.3</span>
    <li><a href="#authenticator-data-for-the-attestation">authenticator data for the attestation</a><span>, in § 6.5.3</span>
    <li><a href="#assertioncreationdata-authenticatordataresult">authenticatorDataResult</a><span>, in § 5.1.4.1</span>
+   <li>
+    authenticatorDisplayName
+    <ul>
+     <li><a href="#abstract-opdef-credential-record-authenticatordisplayname">abstract-op for credential record</a><span>, in § 4</span>
+     <li><a href="#dom-credentialpropertiesoutput-authenticatordisplayname">dict-member for CredentialPropertiesOutput</a><span>, in § 10.1.3</span>
+    </ul>
    <li><a href="#authenticator-extension">authenticator extension</a><span>, in § 9</span>
    <li><a href="#authenticator-extension-capabilities">Authenticator Extension Capabilities</a><span>, in § 11.1.1</span>
    <li><a href="#authenticator-extension-input">authenticator extension input</a><span>, in § 9.3</span>
@@ -9063,7 +9199,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#conforming-user-agent">Conforming User Agent</a><span>, in § 4</span>
    <li><a href="#contains">contains</a><span>, in § 4</span>
    <li><a href="#typedefdef-cosealgorithmidentifier">COSEAlgorithmIdentifier</a><span>, in § 5.8.5</span>
-   <li><a href="#abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a><span>, in § 10.2.2.3.2</span>
+   <li><a href="#abstract-opdef-create-a-new-supplemental-public-key-record">Create a new supplemental public key record</a><span>, in § 10.2.2.3.2</span>
    <li><a href="#created-on">created on</a><span>, in § 4</span>
    <li><a href="#dom-publickeycredential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.3</span>
    <li><a href="#credential-descriptor-for-a-credential-record">credential descriptor for a credential record</a><span>, in § 4</span>
@@ -9093,19 +9229,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticatorattachment-cross-platform">cross-platform</a><span>, in § 5.4.5</span>
    <li><a href="#cross-platform-attachment">cross-platform attachment</a><span>, in § 6.2.1</span>
    <li><a href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</a><span>, in § 4</span>
-   <li><a href="#device-bound-key">Device-bound Key</a><span>, in § 4</span>
-   <li><a href="#credential-record-device-bound-key-record">device-bound key record</a><span>, in § 10.2.2.3</span>
-   <li><a href="#device-private-key">Device Private Key</a><span>, in § 4</span>
-   <li>
-    devicePubKey
-    <ul>
-     <li><a href="#devicepubkey">definition of</a><span>, in § 10.2.2</span>
-     <li><a href="#dom-authenticationextensionsclientinputs-devicepubkey">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2.2.2</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-devicepubkey">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2.2.2</span>
-    </ul>
-   <li><a href="#abstract-opdef-credential-record-devicepubkeys">devicePubKeys</a><span>, in § 10.2.2.3</span>
-   <li><a href="#device-public-key">Device Public Key</a><span>, in § 4</span>
-   <li><a href="#device-public-key-attestation-object">device public key attestation object</a><span>, in § 10.2.2.2</span>
    <li><a href="#dom-attestationconveyancepreference-direct">"direct"</a><span>, in § 5.4.7</span>
    <li><a href="#dom-attestationconveyancepreference-direct">direct</a><span>, in § 5.4.7</span>
    <li>
@@ -9131,7 +9254,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-publickeycredentialuserentity-displayname">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
      <li><a href="#dom-publickeycredentialuserentityjson-displayname">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.9</span>
     </ul>
-   <li><a href="#abstract-opdef-devicepubkey-record-dpk">dpk</a><span>, in § 10.2.2.3</span>
    <li><a href="#authdata-flags-ed">ED</a><span>, in § 6.1</span>
    <li><a href="#effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a><span>, in § 5.1.3</span>
    <li><a href="#effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</a><span>, in § 5.1.4.2</span>
@@ -9160,7 +9282,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticationextensionsprfvalues-first">first</a><span>, in § 10.1.4</span>
    <li><a href="#first-factor-roaming-authenticator">First-factor roaming authenticator</a><span>, in § 6.2</span>
    <li><a href="#authdata-flags">flags</a><span>, in § 6.1</span>
-   <li><a href="#abstract-opdef-devicepubkey-record-fmt">fmt</a><span>, in § 10.2.2.3</span>
+   <li><a href="#abstract-opdef-supplementalpubkeys-record-fmt">fmt</a><span>, in § 10.2.2.3</span>
    <li><a href="#generating-authenticator">Generating Authenticator</a><span>, in § 4</span>
    <li><a href="#dom-authenticatorattestationresponse-getauthenticatordata">getAuthenticatorData()</a><span>, in § 5.2.1</span>
    <li><a href="#dom-publickeycredential-getclientextensionresults">getClientExtensionResults()</a><span>, in § 5.1</span>
@@ -9168,7 +9290,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticatorattestationresponse-getpublickey">getPublicKey()</a><span>, in § 5.2.1</span>
    <li><a href="#dom-authenticatorattestationresponse-getpublickeyalgorithm">getPublicKeyAlgorithm()</a><span>, in § 5.2.1</span>
    <li><a href="#dom-authenticatorattestationresponse-gettransports">getTransports()</a><span>, in § 5.2.1</span>
-   <li><a href="#hardware-bound-device-key-pair">Hardware-bound Device Key Pair</a><span>, in § 4</span>
    <li><a href="#collectedclientdata-hash-of-the-serialized-client-data">Hash of the serialized client data</a><span>, in § 5.8.1</span>
    <li>
     hints
@@ -9328,6 +9449,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-registrationresponsejson-rawid">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#dom-authenticationextensionslargeblobinputs-read">read</a><span>, in § 10.1.5</span>
+   <li><a href="#recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</a><span>, in § 15.1</span>
    <li><a href="#registration">Registration</a><span>, in § 4</span>
    <li><a href="#registration-ceremony">Registration Ceremony</a><span>, in § 4</span>
    <li><a href="#registration-extension">registration extension</a><span>, in § 9</span>
@@ -9385,9 +9507,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     scope
     <ul>
-     <li><a href="#abstract-opdef-devicepubkey-record-scope">abstract-op for devicePubKey record</a><span>, in § 10.2.2.3</span>
+     <li><a href="#abstract-opdef-supplementalpubkeys-record-scope">abstract-op for supplementalPubKeys record</a><span>, in § 10.2.2.3</span>
      <li><a href="#scope">definition of</a><span>, in § 4</span>
     </ul>
+   <li><a href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes">scopes</a><span>, in § 10.2.2.2</span>
    <li><a href="#dom-authenticationextensionsprfvalues-second">second</a><span>, in § 10.1.4</span>
    <li><a href="#second-factor-platform-authenticator">Second-factor platform authenticator</a><span>, in § 6.2</span>
    <li><a href="#second-factor-roaming-authenticator">Second-factor roaming authenticator</a><span>, in § 6.2</span>
@@ -9404,11 +9527,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     signature
     <ul>
      <li><a href="#dom-authenticatorassertionresponse-signature">attribute for AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
-     <li><a href="#dom-authenticationextensionsdevicepublickeyoutputs-signature">dict-member for AuthenticationExtensionsDevicePublicKeyOutputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-authenticatorassertionresponsejson-signature">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#signature-counter">Signature Counter</a><span>, in § 6.1.1</span>
    <li><a href="#assertioncreationdata-signatureresult">signatureResult</a><span>, in § 5.1.4.1</span>
+   <li><a href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures">signatures</a><span>, in § 10.2.2.2</span>
    <li>
     signCount
     <ul>
@@ -9421,8 +9544,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#single-factor-capable">single-factor capable</a><span>, in § 6.2.3</span>
    <li><a href="#dom-authenticatortransport-smart-card">"smart-card"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-smart-card">smart-card</a><span>, in § 5.8.4</span>
+   <li><a href="#abstract-opdef-supplementalpubkeys-record-spk">spk</a><span>, in § 10.2.2.3</span>
    <li><a href="#dom-tokenbinding-status">status</a><span>, in § 5.8.1</span>
    <li><a href="#dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a><span>, in § 5.1.5</span>
+   <li>
+    supplementalPubKeys
+    <ul>
+     <li><a href="#abstract-opdef-credential-record-supplementalpubkeys">abstract-op for credential record</a><span>, in § 10.2.2.3</span>
+     <li><a href="#supplementalpubkeys">definition of</a><span>, in § 10.2.2</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-supplementalpubkeys">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2.2.2</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2.2.2</span>
+    </ul>
+   <li><a href="#supplemental-public-key">Supplemental public key</a><span>, in § 4</span>
+   <li><a href="#credential-record-supplemental-public-key-record">supplemental public key record</a><span>, in § 10.2.2.3</span>
    <li><a href="#dom-authenticationextensionslargeblobinputs-support">support</a><span>, in § 10.1.5</span>
    <li><a href="#dom-tokenbindingstatus-supported">"supported"</a><span>, in § 5.8.1</span>
    <li>
@@ -9640,6 +9774,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="d7d642a2">input</span>
      <li><span class="dfn-paneled" id="a76569bf">is a registrable domain suffix of or is equal to</span>
      <li><span class="dfn-paneled" id="4a044e45">is not a registrable domain suffix of and is not equal to</span>
+     <li><span class="dfn-paneled" id="d74c0894">non-autofill credential type</span>
      <li><span class="dfn-paneled" id="e0660c76">opaque origin</span>
      <li><span class="dfn-paneled" id="a944ac4c">origin</span>
      <li><span class="dfn-paneled" id="43ac8374">origin <small>(for environment settings object)</small></span>
@@ -9671,10 +9806,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="1243a891">exist</span>
      <li><span class="dfn-paneled" id="16d07e10">for each <small>(for list)</small></span>
      <li><span class="dfn-paneled" id="45209803">for each <small>(for map)</small></span>
+     <li><span class="dfn-paneled" id="e5ea84f2">intersection</span>
      <li><span class="dfn-paneled" id="6b815fdd">is empty</span>
      <li><span class="dfn-paneled" id="dd460c8e">is not empty</span>
      <li><span class="dfn-paneled" id="5afbefcd">item <small>(for list)</small></span>
      <li><span class="dfn-paneled" id="c88f3887">item <small>(for struct)</small></span>
+     <li><span class="dfn-paneled" id="f02cd417">iterate</span>
      <li><span class="dfn-paneled" id="d14a6f26">key</span>
      <li><span class="dfn-paneled" id="649608b9">list</span>
      <li><span class="dfn-paneled" id="3fca5a9e">map</span>
@@ -9774,11 +9911,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="79cad4dd">valid domain</span>
      <li><span class="dfn-paneled" id="8de17130">valid domain string</span>
     </ul>
-   <li>
-    <a data-link-type="biblio">[WEBAUTHN-3]</a> defines the following terms:
-    <ul>
-     <li><span class="dfn-paneled" id="70ef57c8">tokenBinding</span>
-    </ul>
    <li>
     <a data-link-type="biblio">[WebDriver]</a> defines the following terms:
     <ul>
@@ -9824,6 +9956,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="7b052415">json type</span>
      <li><span class="dfn-paneled" id="f8de33a3">long</span>
      <li><span class="dfn-paneled" id="9aeb0a82">long long</span>
+     <li><span class="dfn-paneled" id="efd1ec5d">object</span>
      <li><span class="dfn-paneled" id="7787d359">record</span>
      <li><span class="dfn-paneled" id="9cce47fd">sequence</span>
      <li><span class="dfn-paneled" id="e97a9688">unsigned long</span>
@@ -9850,7 +9983,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-fido-appid">[FIDO-APPID]
    <dd>D. Balfanz; et al. <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html"><cite>FIDO AppID and Facet Specification</cite></a>. 27 February 2018. FIDO Alliance Implementation Draft. URL: <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html">https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html</a>
    <dt id="biblio-fido-ctap">[FIDO-CTAP]
-   <dd>J. Bradley; et al. <a href="https://fidoalliance.org/specs/fido-v2.1-rd-20210309/fido-client-to-authenticator-protocol-v2.1-rd-20210309.html"><cite>Client to Authenticator Protocol</cite></a>. 9 March 2021. FIDO Alliance Review Draft. URL: <a href="https://fidoalliance.org/specs/fido-v2.1-rd-20210309/fido-client-to-authenticator-protocol-v2.1-rd-20210309.html">https://fidoalliance.org/specs/fido-v2.1-rd-20210309/fido-client-to-authenticator-protocol-v2.1-rd-20210309.html</a>
+   <dd>J. Bradley; et al. <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html"><cite>Client to Authenticator Protocol (CTAP)</cite></a>. 15 June 2021. FIDO Alliance Proposed Standard. URL: <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html">https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html</a>
    <dt id="biblio-fido-privacy-principles">[FIDO-Privacy-Principles]
    <dd>FIDO Alliance. <a href="https://fidoalliance.org/wp-content/uploads/2014/12/FIDO_Alliance_Whitepaper_Privacy_Principles.pdf"><cite>FIDO Privacy Principles</cite></a>. FIDO Alliance Whitepaper. URL: <a href="https://fidoalliance.org/wp-content/uploads/2014/12/FIDO_Alliance_Whitepaper_Privacy_Principles.pdf">https://fidoalliance.org/wp-content/uploads/2014/12/FIDO_Alliance_Whitepaper_Privacy_Principles.pdf</a>
    <dt id="biblio-fido-registry">[FIDO-Registry]
@@ -9932,9 +10065,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-url">[URL]
    <dd>Anne van Kesteren. <a href="https://url.spec.whatwg.org/"><cite>URL Standard</cite></a>. Living Standard. URL: <a href="https://url.spec.whatwg.org/">https://url.spec.whatwg.org/</a>
    <dt id="biblio-wcag21">[WCAG21]
-   <dd>Andrew Kirkpatrick; et al. <a href="https://w3c.github.io/wcag/21/guidelines/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/21/guidelines/">https://w3c.github.io/wcag/21/guidelines/</a>
-   <dt id="biblio-webauthn-3">[WEBAUTHN-3]
-   <dd>Jeff Hodges; et al. <a href="https://w3c.github.io/webauthn/"><cite>Web Authentication: An API for accessing Public Key Credentials - Level 3</cite></a>. URL: <a href="https://w3c.github.io/webauthn/">https://w3c.github.io/webauthn/</a>
+   <dd>Michael Cooper; et al. <a href="https://w3c.github.io/wcag/guidelines/22/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/guidelines/22/">https://w3c.github.io/wcag/guidelines/22/</a>
    <dt id="biblio-webdriver">[WebDriver]
    <dd>Simon Stewart; David Burns. <a href="https://w3c.github.io/webdriver/"><cite>WebDriver</cite></a>. URL: <a href="https://w3c.github.io/webdriver/">https://w3c.github.io/webdriver/</a>
    <dt id="biblio-webidl">[WebIDL]
@@ -9984,14 +10115,16 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> : <a data-link-type="idl-name" href="https://w3c.github.io/webappsec-credential-management/#credential"><c- n>Credential</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>              <a data-readonly data-type="ArrayBuffer" href="#dom-publickeycredential-rawid"><code><c- g>rawId</c-></code></a>;
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a data-link-type="idl-name" href="#authenticatorresponse"><c- n>AuthenticatorResponse</c-></a>    <a class="idl-code" data-link-type="attribute" data-readonly data-type="AuthenticatorResponse" href="#dom-publickeycredential-response"><c- g>response</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>?               <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
+    <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>?                            <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputs"><c- n>AuthenticationExtensionsClientOutputs</c-></a> <a href="#dom-publickeycredential-getclientextensionresults"><code><c- g>getClientExtensionResults</c-></code></a>();
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>> <a href="#dom-publickeycredential-isconditionalmediationavailable"><code><c- g>isConditionalMediationAvailable</c-></code></a>();
     <a data-link-type="idl-name" href="#typedefdef-publickeycredentialjson"><c- n>PublicKeyCredentialJSON</c-></a> <a href="#dom-publickeycredential-tojson"><code><c- g>toJSON</c-></code></a>();
 };
 
 <c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a href="#typedefdef-base64urlstring"><code><c- g>Base64URLString</c-></code></a>;
-<c- b>typedef</c-> (<a data-link-type="idl-name" href="#dictdef-registrationresponsejson"><c- n>RegistrationResponseJSON</c-></a> <c- b>or</c-> <a data-link-type="idl-name" href="#dictdef-authenticationresponsejson"><c- n>AuthenticationResponseJSON</c-></a>) <a href="#typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></a>;
+// The structure of this object will be either
+// RegistrationResponseJSON or AuthenticationResponseJSON
+<c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-object"><c- b>object</c-></a> <a href="#typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></a>;
 
 <c- b>dictionary</c-> <a href="#dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-registrationresponsejson-id"><code><c- g>id</c-></code></a>;
@@ -10273,6 +10406,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 
 <c- b>dictionary</c-> <a href="#dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk"><c- g>rk</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="USVString " href="#dom-credentialpropertiesoutput-authenticatordisplayname"><c- g>authenticatorDisplayName</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -10338,21 +10472,22 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
   <a data-link-type="idl-name" href="#typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <a data-type="UvmEntries " href="#dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code></a>;
 };
 
-<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsdevicepublickeyinputs"><code><c- g>AuthenticationExtensionsDevicePublicKeyInputs</c-></code></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionsdevicepublickeyinputs-attestation"><c- g>attestation</c-></a> = "none";
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionssupplementalpubkeysinputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysInputs</c-></code></a> {
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionssupplementalpubkeysinputs-scopes"><c- g>scopes</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a class="idl-code" data-default="&quot;indirect&quot;" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionssupplementalpubkeysinputs-attestation"><c- g>attestation</c-></a> = "indirect";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<DOMString> " href="#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"><c- g>attestationFormats</c-></a> = [];
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsdevicepublickeyinputs"><c- n>AuthenticationExtensionsDevicePublicKeyInputs</c-></a> <a data-type="AuthenticationExtensionsDevicePublicKeyInputs " href="#dom-authenticationextensionsclientinputs-devicepubkey"><code><c- g>devicePubKey</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysinputs"><c- n>AuthenticationExtensionsSupplementalPubKeysInputs</c-></a> <a data-type="AuthenticationExtensionsSupplementalPubKeysInputs " href="#dom-authenticationextensionsclientinputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></a>;
 };
 
-<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsdevicepublickeyoutputs"><code><c- g>AuthenticationExtensionsDevicePublicKeyOutputs</c-></code></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a> <a data-type="ArrayBuffer " href="#dom-authenticationextensionsdevicepublickeyoutputs-signature"><code><c- g>signature</c-></code></a>;
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionssupplementalpubkeysoutputs"><code><c- g>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></code></a> {
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>> <a data-type="sequence<ArrayBuffer> " href="#dom-authenticationextensionssupplementalpubkeysoutputs-signatures"><code><c- g>signatures</c-></code></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsdevicepublickeyoutputs"><c- n>AuthenticationExtensionsDevicePublicKeyOutputs</c-></a> <a data-type="AuthenticationExtensionsDevicePublicKeyOutputs " href="#dom-authenticationextensionsclientoutputs-devicepubkey"><code><c- g>devicePubKey</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionssupplementalpubkeysoutputs"><c- n>AuthenticationExtensionsSupplementalPubKeysOutputs</c-></a> <a data-type="AuthenticationExtensionsSupplementalPubKeysOutputs " href="#dom-authenticationextensionsclientoutputs-supplementalpubkeys"><code><c- g>supplementalPubKeys</c-></code></a>;
 };
 
 </pre>
@@ -10947,10 +11082,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['ad09952f'] = {"dfnID": "ad09952f", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot", "dfnText": "[[discovery]]", "refSections": [{"refs": [{"id": "ref-for-dom-credential-discovery-slot"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['f41069dd'] = {"dfnID": "f41069dd", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot", "dfnText": "[[type]]", "refSections": [{"refs": [{"id": "ref-for-dom-credential-type-slot"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['f9c635f5'] = {"dfnID": "f9c635f5", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional", "dfnText": "conditional", "refSections": [{"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2461"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2462"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2463"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2465"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2466"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2467"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2468"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u24ea"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2460"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
-window.dfnpanelData['b0f5bc03'] = {"dfnID": "b0f5bc03", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create", "dfnText": "create()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-create"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462"}, {"id": "ref-for-dom-credentialscontainer-create\u2463"}, {"id": "ref-for-dom-credentialscontainer-create\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2465"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2462"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2463"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2467"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2468"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2462"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2466"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2466"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2463\u24ea"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2461"}], "title": "11.6. Get Credentials"}], "external": true};
+window.dfnpanelData['b0f5bc03'] = {"dfnID": "b0f5bc03", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create", "dfnText": "create()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-create"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462"}, {"id": "ref-for-dom-credentialscontainer-create\u2463"}, {"id": "ref-for-dom-credentialscontainer-create\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2465"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2462"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2463"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2467"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2468"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2462"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2466"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2466"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2468"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u24ea"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2461"}], "title": "11.6. Get Credentials"}], "external": true};
 window.dfnpanelData['736ad5f8'] = {"dfnID": "736ad5f8", "url": "https://w3c.github.io/webappsec-credential-management/#concept-credential", "dfnText": "credential", "refSections": [{"refs": [{"id": "ref-for-concept-credential"}, {"id": "ref-for-concept-credential\u2460"}, {"id": "ref-for-concept-credential\u2461"}, {"id": "ref-for-concept-credential\u2462"}, {"id": "ref-for-concept-credential\u2463"}, {"id": "ref-for-concept-credential\u2464"}, {"id": "ref-for-concept-credential\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-credential\u2466"}, {"id": "ref-for-concept-credential\u2467"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-concept-credential\u2468"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u24ea"}, {"id": "ref-for-concept-credential\u2460\u2460"}, {"id": "ref-for-concept-credential\u2460\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2463"}, {"id": "ref-for-concept-credential\u2460\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2466"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2468"}, {"id": "ref-for-concept-credential\u2461\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2460"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2461"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2462"}, {"id": "ref-for-concept-credential\u2461\u2463"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2464"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2465"}, {"id": "ref-for-concept-credential\u2461\u2466"}], "title": "14.4.1. Attestation Privacy"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2467"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": true};
 window.dfnpanelData['944c2033'] = {"dfnID": "944c2033", "url": "https://w3c.github.io/webappsec-credential-management/#credential-source", "dfnText": "credential source", "refSections": [{"refs": [{"id": "ref-for-credential-source"}], "title": "4. Terminology"}], "external": true};
-window.dfnpanelData['99134679'] = {"dfnID": "99134679", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get", "dfnText": "get()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-get"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2464"}, {"id": "ref-for-dom-credentialscontainer-get\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2468"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2461"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u24ea"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2464"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2465"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2467"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u24ea"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2466"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2468"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2462"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2464"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2465"}], "title": "14.6.2. Username Enumeration"}], "external": true};
+window.dfnpanelData['99134679'] = {"dfnID": "99134679", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get", "dfnText": "get()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-get"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2464"}, {"id": "ref-for-dom-credentialscontainer-get\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2468"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2461"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u24ea"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2464"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2465"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2467"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u24ea"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2466"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2468"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2462"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": true};
 window.dfnpanelData['cbdd0aff'] = {"dfnID": "cbdd0aff", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-credential-id"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credential-id\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credential-id\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
 window.dfnpanelData['546b09a7'] = {"dfnID": "546b09a7", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation", "dfnText": "mediation", "refSections": [{"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation\u2460"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation\u2461"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2462"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2463"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2464"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['d0140610'] = {"dfnID": "d0140610", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote", "dfnText": "remote", "refSections": [{"refs": [{"id": "ref-for-dom-credential-discovery-remote"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
@@ -10990,7 +11125,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['3610bd67'] = {"dfnID": "3610bd67", "url": "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use", "dfnText": "allowed to use", "refSections": [{"refs": [{"id": "ref-for-allowed-to-use"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2460"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2461"}, {"id": "ref-for-allowed-to-use\u2462"}], "title": "5.9. Permissions Policy integration"}], "external": true};
 window.dfnpanelData['b410a6ef'] = {"dfnID": "b410a6ef", "url": "https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin", "dfnText": "ascii serialization of an origin", "refSections": [{"refs": [{"id": "ref-for-ascii-serialisation-of-an-origin"}, {"id": "ref-for-ascii-serialisation-of-an-origin\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ascii-serialisation-of-an-origin\u2461"}, {"id": "ref-for-ascii-serialisation-of-an-origin\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['9d07aa9a'] = {"dfnID": "9d07aa9a", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete", "dfnText": "autocomplete", "refSections": [{"refs": [{"id": "ref-for-attr-fe-autocomplete"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
-window.dfnpanelData['19a777c9'] = {"dfnID": "19a777c9", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens", "dfnText": "autofill detail token", "refSections": [{"refs": [{"id": "ref-for-autofill-detail-tokens"}, {"id": "ref-for-autofill-detail-tokens\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
+window.dfnpanelData['19a777c9'] = {"dfnID": "19a777c9", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens", "dfnText": "autofill detail token", "refSections": [{"refs": [{"id": "ref-for-autofill-detail-tokens"}, {"id": "ref-for-autofill-detail-tokens\u2460"}, {"id": "ref-for-autofill-detail-tokens\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['faf954d6'] = {"dfnID": "faf954d6", "url": "https://html.spec.whatwg.org/multipage/browsers.html#browsing-context", "dfnText": "browsing context", "refSections": [{"refs": [{"id": "ref-for-browsing-context"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-browsing-context\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-browsing-context\u2461"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": true};
 window.dfnpanelData['aca22383'] = {"dfnID": "aca22383", "url": "https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation", "dfnText": "consume user activation", "refSections": [{"refs": [{"id": "ref-for-consume-user-activation"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['12b8dfc0'] = {"dfnID": "12b8dfc0", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object", "dfnText": "current settings object", "refSections": [{"refs": [{"id": "ref-for-current-settings-object"}], "title": "5.9. Permissions Policy integration"}], "external": true};
@@ -11003,6 +11138,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['d7d642a2'] = {"dfnID": "d7d642a2", "url": "https://html.spec.whatwg.org/multipage/input.html#the-input-element", "dfnText": "input", "refSections": [{"refs": [{"id": "ref-for-the-input-element"}, {"id": "ref-for-the-input-element\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['a76569bf'] = {"dfnID": "a76569bf", "url": "https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to", "dfnText": "is a registrable domain suffix of or is equal to", "refSections": [{"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}, {"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['4a044e45'] = {"dfnID": "4a044e45", "url": "https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to", "dfnText": "is not a registrable domain suffix of and is not equal to", "refSections": [{"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2460"}, {"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
+window.dfnpanelData['d74c0894'] = {"dfnID": "d74c0894", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#non-autofill-credential-type", "dfnText": "non-autofill credential type", "refSections": [{"refs": [{"id": "ref-for-non-autofill-credential-type"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['e0660c76'] = {"dfnID": "e0660c76", "url": "https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque", "dfnText": "opaque origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin-opaque"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['a944ac4c'] = {"dfnID": "a944ac4c", "url": "https://html.spec.whatwg.org/multipage/origin.html#concept-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-concept-origin\u2460"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-concept-origin\u2461"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-concept-origin\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-origin\u2463"}, {"id": "ref-for-concept-origin\u2464"}, {"id": "ref-for-concept-origin\u2465"}, {"id": "ref-for-concept-origin\u2466"}, {"id": "ref-for-concept-origin\u2467"}, {"id": "ref-for-concept-origin\u2468"}, {"id": "ref-for-concept-origin\u2460\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2462"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2463"}, {"id": "ref-for-concept-origin\u2460\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2465"}, {"id": "ref-for-concept-origin\u2460\u2466"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2468"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
 window.dfnpanelData['43ac8374'] = {"dfnID": "43ac8374", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin", "dfnText": "origin (for environment settings object)", "refSections": [{"refs": [{"id": "ref-for-concept-settings-object-origin"}, {"id": "ref-for-concept-settings-object-origin\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2461"}, {"id": "ref-for-concept-settings-object-origin\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2463"}, {"id": "ref-for-concept-settings-object-origin\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": true};
@@ -11021,25 +11157,27 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['36858240'] = {"dfnID": "36858240", "url": "https://infra.spec.whatwg.org/#boolean", "dfnText": "boolean", "refSections": [{"refs": [{"id": "ref-for-boolean"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-boolean\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}], "external": true};
 window.dfnpanelData['3de9e659'] = {"dfnID": "3de9e659", "url": "https://infra.spec.whatwg.org/#byte-sequence", "dfnText": "byte sequence", "refSections": [{"refs": [{"id": "ref-for-byte-sequence"}, {"id": "ref-for-byte-sequence\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-byte-sequence\u2461"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}], "external": true};
 window.dfnpanelData['f937b7b6'] = {"dfnID": "f937b7b6", "url": "https://infra.spec.whatwg.org/#iteration-continue", "dfnText": "continue", "refSections": [{"refs": [{"id": "ref-for-iteration-continue"}, {"id": "ref-for-iteration-continue\u2460"}, {"id": "ref-for-iteration-continue\u2461"}, {"id": "ref-for-iteration-continue\u2462"}, {"id": "ref-for-iteration-continue\u2463"}, {"id": "ref-for-iteration-continue\u2464"}, {"id": "ref-for-iteration-continue\u2465"}, {"id": "ref-for-iteration-continue\u2466"}, {"id": "ref-for-iteration-continue\u2467"}, {"id": "ref-for-iteration-continue\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-iteration-continue\u2460\u24ea"}, {"id": "ref-for-iteration-continue\u2460\u2460"}, {"id": "ref-for-iteration-continue\u2460\u2461"}, {"id": "ref-for-iteration-continue\u2460\u2462"}, {"id": "ref-for-iteration-continue\u2460\u2463"}, {"id": "ref-for-iteration-continue\u2460\u2464"}, {"id": "ref-for-iteration-continue\u2460\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-iteration-continue\u2460\u2466"}, {"id": "ref-for-iteration-continue\u2460\u2467"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-iteration-continue\u2460\u2468"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
-window.dfnpanelData['03afaf9c'] = {"dfnID": "03afaf9c", "url": "https://infra.spec.whatwg.org/#list-empty", "dfnText": "empty", "refSections": [{"refs": [{"id": "ref-for-list-empty"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-empty\u2460"}, {"id": "ref-for-list-empty\u2461"}, {"id": "ref-for-list-empty\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-empty\u2463"}, {"id": "ref-for-list-empty\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-empty\u2465"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-list-empty\u2466"}, {"id": "ref-for-list-empty\u2467"}, {"id": "ref-for-list-empty\u2468"}, {"id": "ref-for-list-empty\u2460\u24ea"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2460"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2461"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": true};
+window.dfnpanelData['03afaf9c'] = {"dfnID": "03afaf9c", "url": "https://infra.spec.whatwg.org/#list-empty", "dfnText": "empty", "refSections": [{"refs": [{"id": "ref-for-list-empty"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-empty\u2460"}, {"id": "ref-for-list-empty\u2461"}, {"id": "ref-for-list-empty\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-empty\u2463"}, {"id": "ref-for-list-empty\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-empty\u2465"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-list-empty\u2466"}, {"id": "ref-for-list-empty\u2467"}, {"id": "ref-for-list-empty\u2468"}, {"id": "ref-for-list-empty\u2460\u24ea"}, {"id": "ref-for-list-empty\u2460\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2461"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2462"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": true};
 window.dfnpanelData['8958b003'] = {"dfnID": "8958b003", "url": "https://infra.spec.whatwg.org/#map-entry", "dfnText": "entry", "refSections": [{"refs": [{"id": "ref-for-map-entry"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-entry\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['1243a891'] = {"dfnID": "1243a891", "url": "https://infra.spec.whatwg.org/#map-exists", "dfnText": "exist", "refSections": [{"refs": [{"id": "ref-for-map-exists"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-map-exists\u2460"}, {"id": "ref-for-map-exists\u2461"}, {"id": "ref-for-map-exists\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-map-exists\u2463"}, {"id": "ref-for-map-exists\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-map-exists\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-map-exists\u2466"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-map-exists\u2467"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
-window.dfnpanelData['16d07e10'] = {"dfnID": "16d07e10", "url": "https://infra.spec.whatwg.org/#list-iterate", "dfnText": "for each (for list)", "refSections": [{"refs": [{"id": "ref-for-list-iterate"}, {"id": "ref-for-list-iterate\u2460"}, {"id": "ref-for-list-iterate\u2461"}, {"id": "ref-for-list-iterate\u2462"}, {"id": "ref-for-list-iterate\u2463"}, {"id": "ref-for-list-iterate\u2464"}, {"id": "ref-for-list-iterate\u2465"}, {"id": "ref-for-list-iterate\u2466"}, {"id": "ref-for-list-iterate\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2468"}, {"id": "ref-for-list-iterate\u2460\u24ea"}, {"id": "ref-for-list-iterate\u2460\u2460"}, {"id": "ref-for-list-iterate\u2460\u2461"}, {"id": "ref-for-list-iterate\u2460\u2462"}, {"id": "ref-for-list-iterate\u2460\u2463"}, {"id": "ref-for-list-iterate\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2466"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2468"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u24ea"}, {"id": "ref-for-list-iterate\u2461\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
-window.dfnpanelData['45209803'] = {"dfnID": "45209803", "url": "https://infra.spec.whatwg.org/#map-iterate", "dfnText": "for each (for map)", "refSections": [{"refs": [{"id": "ref-for-map-iterate"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2461"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-map-iterate\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2463"}, {"id": "ref-for-map-iterate\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
+window.dfnpanelData['16d07e10'] = {"dfnID": "16d07e10", "url": "https://infra.spec.whatwg.org/#list-iterate", "dfnText": "for each (for list)", "refSections": [{"refs": [{"id": "ref-for-list-iterate"}, {"id": "ref-for-list-iterate\u2460"}, {"id": "ref-for-list-iterate\u2461"}, {"id": "ref-for-list-iterate\u2462"}, {"id": "ref-for-list-iterate\u2463"}, {"id": "ref-for-list-iterate\u2464"}, {"id": "ref-for-list-iterate\u2465"}, {"id": "ref-for-list-iterate\u2466"}, {"id": "ref-for-list-iterate\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2468"}, {"id": "ref-for-list-iterate\u2460\u24ea"}, {"id": "ref-for-list-iterate\u2460\u2460"}, {"id": "ref-for-list-iterate\u2460\u2461"}, {"id": "ref-for-list-iterate\u2460\u2462"}, {"id": "ref-for-list-iterate\u2460\u2463"}, {"id": "ref-for-list-iterate\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2466"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2468"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u24ea"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u2461"}, {"id": "ref-for-list-iterate\u2461\u2462"}, {"id": "ref-for-list-iterate\u2461\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
+window.dfnpanelData['45209803'] = {"dfnID": "45209803", "url": "https://infra.spec.whatwg.org/#map-iterate", "dfnText": "for each (for map)", "refSections": [{"refs": [{"id": "ref-for-map-iterate"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2461"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-map-iterate\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2463"}, {"id": "ref-for-map-iterate\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-map-iterate\u2466"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['e5ea84f2'] = {"dfnID": "e5ea84f2", "url": "https://infra.spec.whatwg.org/#set-intersection", "dfnText": "intersection", "refSections": [{"refs": [{"id": "ref-for-set-intersection"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
 window.dfnpanelData['6b815fdd'] = {"dfnID": "6b815fdd", "url": "https://infra.spec.whatwg.org/#list-is-empty", "dfnText": "is empty", "refSections": [{"refs": [{"id": "ref-for-list-is-empty"}, {"id": "ref-for-list-is-empty\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-is-empty\u2461"}, {"id": "ref-for-list-is-empty\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2463"}, {"id": "ref-for-list-is-empty\u2464"}, {"id": "ref-for-list-is-empty\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2466"}, {"id": "ref-for-list-is-empty\u2467"}, {"id": "ref-for-list-is-empty\u2468"}, {"id": "ref-for-list-is-empty\u2460\u24ea"}, {"id": "ref-for-list-is-empty\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2462"}, {"id": "ref-for-list-is-empty\u2460\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
 window.dfnpanelData['dd460c8e'] = {"dfnID": "dd460c8e", "url": "https://infra.spec.whatwg.org/#list-is-empty", "dfnText": "is not empty", "refSections": [{"refs": [{"id": "ref-for-list-is-empty"}, {"id": "ref-for-list-is-empty\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-is-empty\u2461"}, {"id": "ref-for-list-is-empty\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2463"}, {"id": "ref-for-list-is-empty\u2464"}, {"id": "ref-for-list-is-empty\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2466"}, {"id": "ref-for-list-is-empty\u2467"}, {"id": "ref-for-list-is-empty\u2468"}, {"id": "ref-for-list-is-empty\u2460\u24ea"}, {"id": "ref-for-list-is-empty\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2462"}, {"id": "ref-for-list-is-empty\u2460\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
-window.dfnpanelData['5afbefcd'] = {"dfnID": "5afbefcd", "url": "https://infra.spec.whatwg.org/#list-item", "dfnText": "item (for list)", "refSections": [{"refs": [{"id": "ref-for-list-item"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-item\u2460"}, {"id": "ref-for-list-item\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2462"}, {"id": "ref-for-list-item\u2463"}, {"id": "ref-for-list-item\u2464"}, {"id": "ref-for-list-item\u2465"}, {"id": "ref-for-list-item\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-item\u2468"}, {"id": "ref-for-list-item\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2461"}], "title": "7.1. Registering a New Credential"}], "external": true};
-window.dfnpanelData['c88f3887'] = {"dfnID": "c88f3887", "url": "https://infra.spec.whatwg.org/#struct-item", "dfnText": "item (for struct)", "refSections": [{"refs": [{"id": "ref-for-struct-item"}, {"id": "ref-for-struct-item\u2460"}, {"id": "ref-for-struct-item\u2461"}, {"id": "ref-for-struct-item\u2462"}, {"id": "ref-for-struct-item\u2463"}, {"id": "ref-for-struct-item\u2464"}, {"id": "ref-for-struct-item\u2465"}, {"id": "ref-for-struct-item\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-struct-item\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2460\u24ea"}, {"id": "ref-for-struct-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-struct-item\u2460\u2461"}, {"id": "ref-for-struct-item\u2460\u2462"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": true};
+window.dfnpanelData['5afbefcd'] = {"dfnID": "5afbefcd", "url": "https://infra.spec.whatwg.org/#list-item", "dfnText": "item (for list)", "refSections": [{"refs": [{"id": "ref-for-list-item"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-item\u2460"}, {"id": "ref-for-list-item\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2462"}, {"id": "ref-for-list-item\u2463"}, {"id": "ref-for-list-item\u2464"}, {"id": "ref-for-list-item\u2465"}, {"id": "ref-for-list-item\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-item\u2468"}, {"id": "ref-for-list-item\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-list-item\u2460\u2462"}], "title": "8.9. Compound Attestation Statement Format"}], "external": true};
+window.dfnpanelData['c88f3887'] = {"dfnID": "c88f3887", "url": "https://infra.spec.whatwg.org/#struct-item", "dfnText": "item (for struct)", "refSections": [{"refs": [{"id": "ref-for-struct-item"}, {"id": "ref-for-struct-item\u2460"}, {"id": "ref-for-struct-item\u2461"}, {"id": "ref-for-struct-item\u2462"}, {"id": "ref-for-struct-item\u2463"}, {"id": "ref-for-struct-item\u2464"}, {"id": "ref-for-struct-item\u2465"}, {"id": "ref-for-struct-item\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-struct-item\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2460\u24ea"}, {"id": "ref-for-struct-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-struct-item\u2460\u2461"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-struct-item\u2460\u2462"}, {"id": "ref-for-struct-item\u2460\u2463"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": true};
+window.dfnpanelData['f02cd417'] = {"dfnID": "f02cd417", "url": "https://infra.spec.whatwg.org/#list-iterate", "dfnText": "iterate", "refSections": [{"refs": [{"id": "ref-for-list-iterate"}, {"id": "ref-for-list-iterate\u2460"}, {"id": "ref-for-list-iterate\u2461"}, {"id": "ref-for-list-iterate\u2462"}, {"id": "ref-for-list-iterate\u2463"}, {"id": "ref-for-list-iterate\u2464"}, {"id": "ref-for-list-iterate\u2465"}, {"id": "ref-for-list-iterate\u2466"}, {"id": "ref-for-list-iterate\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2468"}, {"id": "ref-for-list-iterate\u2460\u24ea"}, {"id": "ref-for-list-iterate\u2460\u2460"}, {"id": "ref-for-list-iterate\u2460\u2461"}, {"id": "ref-for-list-iterate\u2460\u2462"}, {"id": "ref-for-list-iterate\u2460\u2463"}, {"id": "ref-for-list-iterate\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2466"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2468"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u24ea"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u2461"}, {"id": "ref-for-list-iterate\u2461\u2462"}, {"id": "ref-for-list-iterate\u2461\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
 window.dfnpanelData['d14a6f26'] = {"dfnID": "d14a6f26", "url": "https://infra.spec.whatwg.org/#map-key", "dfnText": "key", "refSections": [{"refs": [{"id": "ref-for-map-key"}, {"id": "ref-for-map-key\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['649608b9'] = {"dfnID": "649608b9", "url": "https://infra.spec.whatwg.org/#list", "dfnText": "list", "refSections": [{"refs": [{"id": "ref-for-list"}, {"id": "ref-for-list\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list\u2461"}, {"id": "ref-for-list\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
 window.dfnpanelData['3fca5a9e'] = {"dfnID": "3fca5a9e", "url": "https://infra.spec.whatwg.org/#ordered-map", "dfnText": "map", "refSections": [{"refs": [{"id": "ref-for-ordered-map"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-ordered-map\u2460"}, {"id": "ref-for-ordered-map\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-map\u2462"}, {"id": "ref-for-ordered-map\u2463"}, {"id": "ref-for-ordered-map\u2464"}, {"id": "ref-for-ordered-map\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-map\u2466"}, {"id": "ref-for-ordered-map\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-ordered-map\u2468"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-ordered-map\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-ordered-map\u2460\u2460"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-ordered-map\u2460\u2461"}], "title": "9.4. Client Extension Processing"}], "external": true};
-window.dfnpanelData['692595fe'] = {"dfnID": "692595fe", "url": "https://infra.spec.whatwg.org/#ordered-set", "dfnText": "ordered set", "refSections": [{"refs": [{"id": "ref-for-ordered-set"}, {"id": "ref-for-ordered-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2461"}, {"id": "ref-for-ordered-set\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2463"}, {"id": "ref-for-ordered-set\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-ordered-set\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-ordered-set\u2466"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-ordered-set\u2467"}, {"id": "ref-for-ordered-set\u2468"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
+window.dfnpanelData['692595fe'] = {"dfnID": "692595fe", "url": "https://infra.spec.whatwg.org/#ordered-set", "dfnText": "ordered set", "refSections": [{"refs": [{"id": "ref-for-ordered-set"}, {"id": "ref-for-ordered-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2461"}, {"id": "ref-for-ordered-set\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2463"}, {"id": "ref-for-ordered-set\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-ordered-set\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-ordered-set\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-ordered-set\u2467"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-ordered-set\u2468"}, {"id": "ref-for-ordered-set\u2460\u24ea"}, {"id": "ref-for-ordered-set\u2460\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
 window.dfnpanelData['99c988d6'] = {"dfnID": "99c988d6", "url": "https://infra.spec.whatwg.org/#list-remove", "dfnText": "remove", "refSections": [{"refs": [{"id": "ref-for-list-remove"}, {"id": "ref-for-list-remove\u2460"}, {"id": "ref-for-list-remove\u2461"}, {"id": "ref-for-list-remove\u2462"}, {"id": "ref-for-list-remove\u2463"}, {"id": "ref-for-list-remove\u2464"}, {"id": "ref-for-list-remove\u2465"}, {"id": "ref-for-list-remove\u2466"}, {"id": "ref-for-list-remove\u2467"}, {"id": "ref-for-list-remove\u2468"}, {"id": "ref-for-list-remove\u2460\u24ea"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-remove\u2460\u2460"}, {"id": "ref-for-list-remove\u2460\u2461"}, {"id": "ref-for-list-remove\u2460\u2462"}, {"id": "ref-for-list-remove\u2460\u2463"}, {"id": "ref-for-list-remove\u2460\u2464"}, {"id": "ref-for-list-remove\u2460\u2465"}, {"id": "ref-for-list-remove\u2460\u2466"}, {"id": "ref-for-list-remove\u2460\u2467"}, {"id": "ref-for-list-remove\u2460\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-remove\u2461\u24ea"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
 window.dfnpanelData['ab309409'] = {"dfnID": "ab309409", "url": "https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes", "dfnText": "serialize json to bytes", "refSections": [{"refs": [{"id": "ref-for-serialize-a-javascript-value-to-json-bytes"}, {"id": "ref-for-serialize-a-javascript-value-to-json-bytes\u2460"}], "title": "5.8.1.1. Serialization"}], "external": true};
-window.dfnpanelData['15e48c39'] = {"dfnID": "15e48c39", "url": "https://infra.spec.whatwg.org/#ordered-set", "dfnText": "set", "refSections": [{"refs": [{"id": "ref-for-ordered-set"}, {"id": "ref-for-ordered-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2461"}, {"id": "ref-for-ordered-set\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2463"}, {"id": "ref-for-ordered-set\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-ordered-set\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-ordered-set\u2466"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-ordered-set\u2467"}, {"id": "ref-for-ordered-set\u2468"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
-window.dfnpanelData['0e6b2056'] = {"dfnID": "0e6b2056", "url": "https://infra.spec.whatwg.org/#map-set", "dfnText": "set (for map)", "refSections": [{"refs": [{"id": "ref-for-map-set"}, {"id": "ref-for-map-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-set\u2461"}, {"id": "ref-for-map-set\u2462"}, {"id": "ref-for-map-set\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-set\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-map-set\u2465"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": true};
-window.dfnpanelData['0204d188'] = {"dfnID": "0204d188", "url": "https://infra.spec.whatwg.org/#list-size", "dfnText": "size", "refSections": [{"refs": [{"id": "ref-for-list-size"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-size\u2460"}, {"id": "ref-for-list-size\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
-window.dfnpanelData['984221ca'] = {"dfnID": "984221ca", "url": "https://infra.spec.whatwg.org/#struct", "dfnText": "struct", "refSections": [{"refs": [{"id": "ref-for-struct"}, {"id": "ref-for-struct\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-struct\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct\u2463"}, {"id": "ref-for-struct\u2464"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-struct\u2465"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": true};
+window.dfnpanelData['15e48c39'] = {"dfnID": "15e48c39", "url": "https://infra.spec.whatwg.org/#ordered-set", "dfnText": "set", "refSections": [{"refs": [{"id": "ref-for-ordered-set"}, {"id": "ref-for-ordered-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2461"}, {"id": "ref-for-ordered-set\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ordered-set\u2463"}, {"id": "ref-for-ordered-set\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-ordered-set\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-ordered-set\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-ordered-set\u2467"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-ordered-set\u2468"}, {"id": "ref-for-ordered-set\u2460\u24ea"}, {"id": "ref-for-ordered-set\u2460\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
+window.dfnpanelData['0e6b2056'] = {"dfnID": "0e6b2056", "url": "https://infra.spec.whatwg.org/#map-set", "dfnText": "set (for map)", "refSections": [{"refs": [{"id": "ref-for-map-set"}, {"id": "ref-for-map-set\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-set\u2461"}, {"id": "ref-for-map-set\u2462"}, {"id": "ref-for-map-set\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-set\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": true};
+window.dfnpanelData['0204d188'] = {"dfnID": "0204d188", "url": "https://infra.spec.whatwg.org/#list-size", "dfnText": "size", "refSections": [{"refs": [{"id": "ref-for-list-size"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-size\u2460"}, {"id": "ref-for-list-size\u2461"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-list-size\u2462"}, {"id": "ref-for-list-size\u2463"}, {"id": "ref-for-list-size\u2464"}, {"id": "ref-for-list-size\u2465"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
+window.dfnpanelData['984221ca'] = {"dfnID": "984221ca", "url": "https://infra.spec.whatwg.org/#struct", "dfnText": "struct", "refSections": [{"refs": [{"id": "ref-for-struct"}, {"id": "ref-for-struct\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-struct\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct\u2463"}, {"id": "ref-for-struct\u2464"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-struct\u2465"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": true};
 window.dfnpanelData['802b0fdd'] = {"dfnID": "802b0fdd", "url": "https://infra.spec.whatwg.org/#map-value", "dfnText": "value", "refSections": [{"refs": [{"id": "ref-for-map-value"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['cbdc89b4'] = {"dfnID": "cbdc89b4", "url": "https://infra.spec.whatwg.org/#iteration-while", "dfnText": "while", "refSections": [{"refs": [{"id": "ref-for-iteration-while"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-iteration-while\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['b0f631d2'] = {"dfnID": "b0f631d2", "url": "https://infra.spec.whatwg.org/#willful-violation", "dfnText": "willful violation", "refSections": [{"refs": [{"id": "ref-for-willful-violation"}], "title": "4. Terminology"}], "external": true};
@@ -11080,7 +11218,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['118b92bb'] = {"dfnID": "118b92bb", "url": "https://url.spec.whatwg.org#concept-url-scheme", "dfnText": "scheme", "refSections": [{"refs": [{"id": "ref-for-concept-url-scheme"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-concept-url-scheme\u2460"}, {"id": "ref-for-concept-url-scheme\u2461"}], "title": "4. Terminology"}], "external": true};
 window.dfnpanelData['79cad4dd'] = {"dfnID": "79cad4dd", "url": "https://url.spec.whatwg.org/#valid-domain", "dfnText": "valid domain", "refSections": [{"refs": [{"id": "ref-for-valid-domain"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-valid-domain\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-valid-domain\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['8de17130'] = {"dfnID": "8de17130", "url": "https://url.spec.whatwg.org/#valid-domain-string", "dfnText": "valid domain string", "refSections": [{"refs": [{"id": "ref-for-valid-domain-string"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-valid-domain-string\u2460"}, {"id": "ref-for-valid-domain-string\u2461"}], "title": "4. Terminology"}], "external": true};
-window.dfnpanelData['70ef57c8'] = {"dfnID": "70ef57c8", "url": "https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding", "dfnText": "tokenBinding", "refSections": [{"refs": [{"id": "ref-for-dom-collectedclientdata-tokenbinding"}, {"id": "ref-for-dom-collectedclientdata-tokenbinding\u2460"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}], "external": true};
 window.dfnpanelData['ee843963'] = {"dfnID": "ee843963", "url": "https://w3c.github.io/webdriver/#dfn-endpoint-node", "dfnText": "endpoint node", "refSections": [{"refs": [{"id": "ref-for-dfn-endpoint-node"}, {"id": "ref-for-dfn-endpoint-node\u2460"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-endpoint-node\u2461"}, {"id": "ref-for-dfn-endpoint-node\u2462"}, {"id": "ref-for-dfn-endpoint-node\u2463"}, {"id": "ref-for-dfn-endpoint-node\u2464"}, {"id": "ref-for-dfn-endpoint-node\u2465"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-dfn-endpoint-node\u2466"}], "title": "11.3. Add Virtual Authenticator"}], "external": true};
 window.dfnpanelData['16d98924'] = {"dfnID": "16d98924", "url": "https://w3c.github.io/webdriver/#dfn-extension-capability", "dfnText": "extension capability", "refSections": [{"refs": [{"id": "ref-for-dfn-extension-capability"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-extension-capability\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}], "external": true};
 window.dfnpanelData['cce1676e'] = {"dfnID": "cce1676e", "url": "https://w3c.github.io/webdriver/#dfn-extension-commands", "dfnText": "extension command", "refSections": [{"refs": [{"id": "ref-for-dfn-extension-commands"}], "title": "11. User Agent Automation"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2460"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2461"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2462"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2463"}], "title": "11.4. Remove Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2464"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2465"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2466"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2467"}], "title": "11.8. Remove All Credentials"}, {"refs": [{"id": "ref-for-dfn-extension-commands\u2468"}], "title": "11.9. Set User Verified"}], "external": true};
@@ -11094,23 +11231,23 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['d78cb661'] = {"dfnID": "d78cb661", "url": "https://w3c.github.io/webdriver/#dfn-validate-capabilities", "dfnText": "validating capabilities", "refSections": [{"refs": [{"id": "ref-for-dfn-validate-capabilities"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-validate-capabilities\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}], "external": true};
 window.dfnpanelData['5cf0e148'] = {"dfnID": "5cf0e148", "url": "https://w3c.github.io/webdriver/#dfn-error", "dfnText": "webdriver error", "refSections": [{"refs": [{"id": "ref-for-dfn-error"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-error\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-dfn-error\u2461"}, {"id": "ref-for-dfn-error\u2462"}, {"id": "ref-for-dfn-error\u2463"}, {"id": "ref-for-dfn-error\u2464"}, {"id": "ref-for-dfn-error\u2465"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-error\u2466"}], "title": "11.4. Remove Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-error\u2467"}, {"id": "ref-for-dfn-error\u2468"}, {"id": "ref-for-dfn-error\u2460\u24ea"}, {"id": "ref-for-dfn-error\u2460\u2460"}, {"id": "ref-for-dfn-error\u2460\u2461"}, {"id": "ref-for-dfn-error\u2460\u2462"}, {"id": "ref-for-dfn-error\u2460\u2463"}, {"id": "ref-for-dfn-error\u2460\u2464"}, {"id": "ref-for-dfn-error\u2460\u2465"}, {"id": "ref-for-dfn-error\u2460\u2466"}, {"id": "ref-for-dfn-error\u2460\u2467"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-dfn-error\u2460\u2468"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-dfn-error\u2461\u24ea"}, {"id": "ref-for-dfn-error\u2461\u2460"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-dfn-error\u2461\u2461"}], "title": "11.8. Remove All Credentials"}, {"refs": [{"id": "ref-for-dfn-error\u2461\u2462"}, {"id": "ref-for-dfn-error\u2461\u2463"}, {"id": "ref-for-dfn-error\u2461\u2464"}], "title": "11.9. Set User Verified"}], "external": true};
 window.dfnpanelData['7482107b'] = {"dfnID": "7482107b", "url": "https://w3c.github.io/webdriver/#dfn-error-code", "dfnText": "webdriver error code", "refSections": [{"refs": [{"id": "ref-for-dfn-error-code"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-dfn-error-code\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-dfn-error-code\u2461"}, {"id": "ref-for-dfn-error-code\u2462"}, {"id": "ref-for-dfn-error-code\u2463"}, {"id": "ref-for-dfn-error-code\u2464"}, {"id": "ref-for-dfn-error-code\u2465"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-error-code\u2466"}], "title": "11.4. Remove Virtual Authenticator"}, {"refs": [{"id": "ref-for-dfn-error-code\u2467"}, {"id": "ref-for-dfn-error-code\u2468"}, {"id": "ref-for-dfn-error-code\u2460\u24ea"}, {"id": "ref-for-dfn-error-code\u2460\u2460"}, {"id": "ref-for-dfn-error-code\u2460\u2461"}, {"id": "ref-for-dfn-error-code\u2460\u2462"}, {"id": "ref-for-dfn-error-code\u2460\u2463"}, {"id": "ref-for-dfn-error-code\u2460\u2464"}, {"id": "ref-for-dfn-error-code\u2460\u2465"}, {"id": "ref-for-dfn-error-code\u2460\u2466"}, {"id": "ref-for-dfn-error-code\u2460\u2467"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-dfn-error-code\u2460\u2468"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-dfn-error-code\u2461\u24ea"}, {"id": "ref-for-dfn-error-code\u2461\u2460"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-dfn-error-code\u2461\u2461"}], "title": "11.8. Remove All Credentials"}, {"refs": [{"id": "ref-for-dfn-error-code\u2461\u2462"}, {"id": "ref-for-dfn-error-code\u2461\u2463"}, {"id": "ref-for-dfn-error-code\u2461\u2464"}], "title": "11.9. Set User Verified"}], "external": true};
-window.dfnpanelData['2f8afbfe'] = {"dfnID": "2f8afbfe", "url": "https://webidl.spec.whatwg.org/#idl-ArrayBuffer", "dfnText": "ArrayBuffer", "refSections": [{"refs": [{"id": "ref-for-idl-ArrayBuffer"}, {"id": "ref-for-idl-ArrayBuffer\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2465"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u24ea"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2460"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2463"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2468"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2462\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['2f8afbfe'] = {"dfnID": "2f8afbfe", "url": "https://webidl.spec.whatwg.org/#idl-ArrayBuffer", "dfnText": "ArrayBuffer", "refSections": [{"refs": [{"id": "ref-for-idl-ArrayBuffer"}, {"id": "ref-for-idl-ArrayBuffer\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2465"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u24ea"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2460"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2463"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2468"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2462\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2462\u2462"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
 window.dfnpanelData['3aff2fb3'] = {"dfnID": "3aff2fb3", "url": "https://webidl.spec.whatwg.org/#BufferSource", "dfnText": "BufferSource", "refSections": [{"refs": [{"id": "ref-for-BufferSource"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-BufferSource\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-BufferSource\u2461"}, {"id": "ref-for-BufferSource\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-BufferSource\u2463"}, {"id": "ref-for-BufferSource\u2464"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-BufferSource\u2465"}, {"id": "ref-for-BufferSource\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-BufferSource\u2467"}, {"id": "ref-for-BufferSource\u2468"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-BufferSource\u2460\u24ea"}, {"id": "ref-for-BufferSource\u2460\u2460"}, {"id": "ref-for-BufferSource\u2460\u2461"}, {"id": "ref-for-BufferSource\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-BufferSource\u2460\u2463"}, {"id": "ref-for-BufferSource\u2460\u2464"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
 window.dfnpanelData['48c6127a'] = {"dfnID": "48c6127a", "url": "https://webidl.spec.whatwg.org/#constrainterror", "dfnText": "ConstraintError", "refSections": [{"refs": [{"id": "ref-for-constrainterror"}, {"id": "ref-for-constrainterror\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": true};
 window.dfnpanelData['dca2de17'] = {"dfnID": "dca2de17", "url": "https://webidl.spec.whatwg.org/#idl-DOMException", "dfnText": "DOMException", "refSections": [{"refs": [{"id": "ref-for-idl-DOMException"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460"}, {"id": "ref-for-idl-DOMException\u2461"}, {"id": "ref-for-idl-DOMException\u2462"}, {"id": "ref-for-idl-DOMException\u2463"}, {"id": "ref-for-idl-DOMException\u2464"}, {"id": "ref-for-idl-DOMException\u2465"}, {"id": "ref-for-idl-DOMException\u2466"}, {"id": "ref-for-idl-DOMException\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2468"}, {"id": "ref-for-idl-DOMException\u2460\u24ea"}, {"id": "ref-for-idl-DOMException\u2460\u2460"}, {"id": "ref-for-idl-DOMException\u2460\u2461"}, {"id": "ref-for-idl-DOMException\u2460\u2462"}, {"id": "ref-for-idl-DOMException\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2464"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2466"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2467"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u24ea"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2461"}, {"id": "ref-for-idl-DOMException\u2461\u2462"}, {"id": "ref-for-idl-DOMException\u2461\u2463"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2464"}, {"id": "ref-for-idl-DOMException\u2461\u2465"}, {"id": "ref-for-idl-DOMException\u2461\u2466"}, {"id": "ref-for-idl-DOMException\u2461\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
-window.dfnpanelData['8855a9aa'] = {"dfnID": "8855a9aa", "url": "https://webidl.spec.whatwg.org/#idl-DOMString", "dfnText": "DOMString", "refSections": [{"refs": [{"id": "ref-for-idl-DOMString"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460"}, {"id": "ref-for-idl-DOMString\u2461"}, {"id": "ref-for-idl-DOMString\u2462"}, {"id": "ref-for-idl-DOMString\u2463"}, {"id": "ref-for-idl-DOMString\u2464"}, {"id": "ref-for-idl-DOMString\u2465"}, {"id": "ref-for-idl-DOMString\u2466"}, {"id": "ref-for-idl-DOMString\u2467"}, {"id": "ref-for-idl-DOMString\u2468"}, {"id": "ref-for-idl-DOMString\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2461"}, {"id": "ref-for-idl-DOMString\u2460\u2462"}, {"id": "ref-for-idl-DOMString\u2460\u2463"}, {"id": "ref-for-idl-DOMString\u2460\u2464"}, {"id": "ref-for-idl-DOMString\u2460\u2465"}, {"id": "ref-for-idl-DOMString\u2460\u2466"}, {"id": "ref-for-idl-DOMString\u2460\u2467"}, {"id": "ref-for-idl-DOMString\u2460\u2468"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u24ea"}, {"id": "ref-for-idl-DOMString\u2461\u2460"}, {"id": "ref-for-idl-DOMString\u2461\u2461"}, {"id": "ref-for-idl-DOMString\u2461\u2462"}, {"id": "ref-for-idl-DOMString\u2461\u2463"}, {"id": "ref-for-idl-DOMString\u2461\u2464"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2465"}, {"id": "ref-for-idl-DOMString\u2461\u2466"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2467"}, {"id": "ref-for-idl-DOMString\u2461\u2468"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u24ea"}, {"id": "ref-for-idl-DOMString\u2462\u2460"}, {"id": "ref-for-idl-DOMString\u2462\u2461"}, {"id": "ref-for-idl-DOMString\u2462\u2462"}, {"id": "ref-for-idl-DOMString\u2462\u2463"}, {"id": "ref-for-idl-DOMString\u2462\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2465"}, {"id": "ref-for-idl-DOMString\u2462\u2466"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2467"}, {"id": "ref-for-idl-DOMString\u2462\u2468"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u24ea"}, {"id": "ref-for-idl-DOMString\u2463\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2461"}, {"id": "ref-for-idl-DOMString\u2463\u2462"}, {"id": "ref-for-idl-DOMString\u2463\u2463"}, {"id": "ref-for-idl-DOMString\u2463\u2464"}, {"id": "ref-for-idl-DOMString\u2463\u2465"}, {"id": "ref-for-idl-DOMString\u2463\u2466"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2467"}, {"id": "ref-for-idl-DOMString\u2463\u2468"}, {"id": "ref-for-idl-DOMString\u2464\u24ea"}, {"id": "ref-for-idl-DOMString\u2464\u2460"}, {"id": "ref-for-idl-DOMString\u2464\u2461"}, {"id": "ref-for-idl-DOMString\u2464\u2462"}, {"id": "ref-for-idl-DOMString\u2464\u2463"}, {"id": "ref-for-idl-DOMString\u2464\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2464\u2465"}, {"id": "ref-for-idl-DOMString\u2464\u2466"}, {"id": "ref-for-idl-DOMString\u2464\u2467"}, {"id": "ref-for-idl-DOMString\u2464\u2468"}, {"id": "ref-for-idl-DOMString\u2465\u24ea"}, {"id": "ref-for-idl-DOMString\u2465\u2460"}, {"id": "ref-for-idl-DOMString\u2465\u2461"}, {"id": "ref-for-idl-DOMString\u2465\u2462"}, {"id": "ref-for-idl-DOMString\u2465\u2463"}, {"id": "ref-for-idl-DOMString\u2465\u2464"}, {"id": "ref-for-idl-DOMString\u2465\u2465"}, {"id": "ref-for-idl-DOMString\u2465\u2466"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2467"}, {"id": "ref-for-idl-DOMString\u2465\u2468"}, {"id": "ref-for-idl-DOMString\u2466\u24ea"}, {"id": "ref-for-idl-DOMString\u2466\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2466\u2461"}, {"id": "ref-for-idl-DOMString\u2466\u2462"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2466\u2463"}, {"id": "ref-for-idl-DOMString\u2466\u2464"}, {"id": "ref-for-idl-DOMString\u2466\u2465"}, {"id": "ref-for-idl-DOMString\u2466\u2466"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['8855a9aa'] = {"dfnID": "8855a9aa", "url": "https://webidl.spec.whatwg.org/#idl-DOMString", "dfnText": "DOMString", "refSections": [{"refs": [{"id": "ref-for-idl-DOMString"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460"}, {"id": "ref-for-idl-DOMString\u2461"}, {"id": "ref-for-idl-DOMString\u2462"}, {"id": "ref-for-idl-DOMString\u2463"}, {"id": "ref-for-idl-DOMString\u2464"}, {"id": "ref-for-idl-DOMString\u2465"}, {"id": "ref-for-idl-DOMString\u2466"}, {"id": "ref-for-idl-DOMString\u2467"}, {"id": "ref-for-idl-DOMString\u2468"}, {"id": "ref-for-idl-DOMString\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2461"}, {"id": "ref-for-idl-DOMString\u2460\u2462"}, {"id": "ref-for-idl-DOMString\u2460\u2463"}, {"id": "ref-for-idl-DOMString\u2460\u2464"}, {"id": "ref-for-idl-DOMString\u2460\u2465"}, {"id": "ref-for-idl-DOMString\u2460\u2466"}, {"id": "ref-for-idl-DOMString\u2460\u2467"}, {"id": "ref-for-idl-DOMString\u2460\u2468"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u24ea"}, {"id": "ref-for-idl-DOMString\u2461\u2460"}, {"id": "ref-for-idl-DOMString\u2461\u2461"}, {"id": "ref-for-idl-DOMString\u2461\u2462"}, {"id": "ref-for-idl-DOMString\u2461\u2463"}, {"id": "ref-for-idl-DOMString\u2461\u2464"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2465"}, {"id": "ref-for-idl-DOMString\u2461\u2466"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2467"}, {"id": "ref-for-idl-DOMString\u2461\u2468"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u24ea"}, {"id": "ref-for-idl-DOMString\u2462\u2460"}, {"id": "ref-for-idl-DOMString\u2462\u2461"}, {"id": "ref-for-idl-DOMString\u2462\u2462"}, {"id": "ref-for-idl-DOMString\u2462\u2463"}, {"id": "ref-for-idl-DOMString\u2462\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2465"}, {"id": "ref-for-idl-DOMString\u2462\u2466"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2467"}, {"id": "ref-for-idl-DOMString\u2462\u2468"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u24ea"}, {"id": "ref-for-idl-DOMString\u2463\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2461"}, {"id": "ref-for-idl-DOMString\u2463\u2462"}, {"id": "ref-for-idl-DOMString\u2463\u2463"}, {"id": "ref-for-idl-DOMString\u2463\u2464"}, {"id": "ref-for-idl-DOMString\u2463\u2465"}, {"id": "ref-for-idl-DOMString\u2463\u2466"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2467"}, {"id": "ref-for-idl-DOMString\u2463\u2468"}, {"id": "ref-for-idl-DOMString\u2464\u24ea"}, {"id": "ref-for-idl-DOMString\u2464\u2460"}, {"id": "ref-for-idl-DOMString\u2464\u2461"}, {"id": "ref-for-idl-DOMString\u2464\u2462"}, {"id": "ref-for-idl-DOMString\u2464\u2463"}, {"id": "ref-for-idl-DOMString\u2464\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2464\u2465"}, {"id": "ref-for-idl-DOMString\u2464\u2466"}, {"id": "ref-for-idl-DOMString\u2464\u2467"}, {"id": "ref-for-idl-DOMString\u2464\u2468"}, {"id": "ref-for-idl-DOMString\u2465\u24ea"}, {"id": "ref-for-idl-DOMString\u2465\u2460"}, {"id": "ref-for-idl-DOMString\u2465\u2461"}, {"id": "ref-for-idl-DOMString\u2465\u2462"}, {"id": "ref-for-idl-DOMString\u2465\u2463"}, {"id": "ref-for-idl-DOMString\u2465\u2464"}, {"id": "ref-for-idl-DOMString\u2465\u2465"}, {"id": "ref-for-idl-DOMString\u2465\u2466"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2467"}, {"id": "ref-for-idl-DOMString\u2465\u2468"}, {"id": "ref-for-idl-DOMString\u2466\u24ea"}, {"id": "ref-for-idl-DOMString\u2466\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2466\u2461"}, {"id": "ref-for-idl-DOMString\u2466\u2462"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2466\u2463"}, {"id": "ref-for-idl-DOMString\u2466\u2464"}, {"id": "ref-for-idl-DOMString\u2466\u2465"}, {"id": "ref-for-idl-DOMString\u2466\u2466"}, {"id": "ref-for-idl-DOMString\u2466\u2467"}, {"id": "ref-for-idl-DOMString\u2466\u2468"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
 window.dfnpanelData['9befea0b'] = {"dfnID": "9befea0b", "url": "https://webidl.spec.whatwg.org/#encodingerror", "dfnText": "EncodingError", "refSections": [{"refs": [{"id": "ref-for-encodingerror"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-encodingerror\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
 window.dfnpanelData['889e932f'] = {"dfnID": "889e932f", "url": "https://webidl.spec.whatwg.org/#Exposed", "dfnText": "Exposed", "refSections": [{"refs": [{"id": "ref-for-Exposed"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-Exposed\u2460"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-Exposed\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-Exposed\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['797018a7'] = {"dfnID": "797018a7", "url": "https://webidl.spec.whatwg.org/#invalidstateerror", "dfnText": "InvalidStateError", "refSections": [{"refs": [{"id": "ref-for-invalidstateerror"}, {"id": "ref-for-invalidstateerror\u2460"}, {"id": "ref-for-invalidstateerror\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-invalidstateerror\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-invalidstateerror\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-invalidstateerror\u2464"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
 window.dfnpanelData['ba556545'] = {"dfnID": "ba556545", "url": "https://webidl.spec.whatwg.org/#notallowederror", "dfnText": "NotAllowedError", "refSections": [{"refs": [{"id": "ref-for-notallowederror"}, {"id": "ref-for-notallowederror\u2460"}, {"id": "ref-for-notallowederror\u2461"}, {"id": "ref-for-notallowederror\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2463"}, {"id": "ref-for-notallowederror\u2464"}, {"id": "ref-for-notallowederror\u2465"}, {"id": "ref-for-notallowederror\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2467"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-notallowederror\u2468"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-notallowederror\u2460\u24ea"}, {"id": "ref-for-notallowederror\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-notallowederror\u2460\u2461"}, {"id": "ref-for-notallowederror\u2460\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
 window.dfnpanelData['3182eb71'] = {"dfnID": "3182eb71", "url": "https://webidl.spec.whatwg.org/#notsupportederror", "dfnText": "NotSupportedError", "refSections": [{"refs": [{"id": "ref-for-notsupportederror"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notsupportederror\u2460"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notsupportederror\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-notsupportederror\u2462"}, {"id": "ref-for-notsupportederror\u2463"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-notsupportederror\u2464"}, {"id": "ref-for-notsupportederror\u2465"}, {"id": "ref-for-notsupportederror\u2466"}, {"id": "ref-for-notsupportederror\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
 window.dfnpanelData['bdbd19d1'] = {"dfnID": "bdbd19d1", "url": "https://webidl.spec.whatwg.org/#idl-promise", "dfnText": "Promise", "refSections": [{"refs": [{"id": "ref-for-idl-promise"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-promise\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-promise\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2463"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-promise\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": true};
-window.dfnpanelData['a5c91173'] = {"dfnID": "a5c91173", "url": "https://webidl.spec.whatwg.org/#SameObject", "dfnText": "SameObject", "refSections": [{"refs": [{"id": "ref-for-SameObject"}, {"id": "ref-for-SameObject\u2460"}, {"id": "ref-for-SameObject\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-SameObject\u2462"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2463"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2464"}, {"id": "ref-for-SameObject\u2465"}, {"id": "ref-for-SameObject\u2466"}, {"id": "ref-for-SameObject\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
+window.dfnpanelData['a5c91173'] = {"dfnID": "a5c91173", "url": "https://webidl.spec.whatwg.org/#SameObject", "dfnText": "SameObject", "refSections": [{"refs": [{"id": "ref-for-SameObject"}, {"id": "ref-for-SameObject\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-SameObject\u2461"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2462"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2463"}, {"id": "ref-for-SameObject\u2464"}, {"id": "ref-for-SameObject\u2465"}, {"id": "ref-for-SameObject\u2466"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['b75bb3bd'] = {"dfnID": "b75bb3bd", "url": "https://webidl.spec.whatwg.org/#SecureContext", "dfnText": "SecureContext", "refSections": [{"refs": [{"id": "ref-for-SecureContext"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-SecureContext\u2460"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-SecureContext\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-SecureContext\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['c3e881ef'] = {"dfnID": "c3e881ef", "url": "https://webidl.spec.whatwg.org/#securityerror", "dfnText": "SecurityError", "refSections": [{"refs": [{"id": "ref-for-securityerror"}, {"id": "ref-for-securityerror\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-securityerror\u2461"}, {"id": "ref-for-securityerror\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-securityerror\u2463"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-securityerror\u2464"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
 window.dfnpanelData['be2d2b4c'] = {"dfnID": "be2d2b4c", "url": "https://webidl.spec.whatwg.org/#syntaxerror", "dfnText": "SyntaxError", "refSections": [{"refs": [{"id": "ref-for-syntaxerror"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['82ca3efc'] = {"dfnID": "82ca3efc", "url": "https://webidl.spec.whatwg.org/#exceptiondef-typeerror", "dfnText": "TypeError", "refSections": [{"refs": [{"id": "ref-for-exceptiondef-typeerror"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
-window.dfnpanelData['b0d7f3c3'] = {"dfnID": "b0d7f3c3", "url": "https://webidl.spec.whatwg.org/#idl-USVString", "dfnText": "USVString", "refSections": [{"refs": [{"id": "ref-for-idl-USVString"}, {"id": "ref-for-idl-USVString\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-USVString\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-USVString\u2462"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-USVString\u2463"}, {"id": "ref-for-idl-USVString\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
+window.dfnpanelData['b0d7f3c3'] = {"dfnID": "b0d7f3c3", "url": "https://webidl.spec.whatwg.org/#idl-USVString", "dfnText": "USVString", "refSections": [{"refs": [{"id": "ref-for-idl-USVString"}, {"id": "ref-for-idl-USVString\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-USVString\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-USVString\u2462"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-USVString\u2463"}, {"id": "ref-for-idl-USVString\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-idl-USVString\u2465"}, {"id": "ref-for-idl-USVString\u2466"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['81dd847b'] = {"dfnID": "81dd847b", "url": "https://webidl.spec.whatwg.org/#unknownerror", "dfnText": "UnknownError", "refSections": [{"refs": [{"id": "ref-for-unknownerror"}, {"id": "ref-for-unknownerror\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-unknownerror\u2461"}, {"id": "ref-for-unknownerror\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
 window.dfnpanelData['5372cca8'] = {"dfnID": "5372cca8", "url": "https://webidl.spec.whatwg.org/#idl-boolean", "dfnText": "boolean", "refSections": [{"refs": [{"id": "ref-for-idl-boolean"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-boolean\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-boolean\u2461"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-boolean\u2462"}, {"id": "ref-for-idl-boolean\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-boolean\u2464"}, {"id": "ref-for-idl-boolean\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-boolean\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-boolean\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-boolean\u2468"}, {"id": "ref-for-idl-boolean\u2460\u24ea"}, {"id": "ref-for-idl-boolean\u2460\u2460"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2461"}, {"id": "ref-for-idl-boolean\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2463"}, {"id": "ref-for-idl-boolean\u2460\u2464"}, {"id": "ref-for-idl-boolean\u2460\u2465"}, {"id": "ref-for-idl-boolean\u2460\u2466"}, {"id": "ref-for-idl-boolean\u2460\u2467"}, {"id": "ref-for-idl-boolean\u2460\u2468"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-boolean\u2461\u24ea"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
 window.dfnpanelData['b05bf85d'] = {"dfnID": "b05bf85d", "url": "https://webidl.spec.whatwg.org/#dfn-buffer-source-type", "dfnText": "buffer source types", "refSections": [{"refs": [{"id": "ref-for-dfn-buffer-source-type"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-buffer-source-type\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
@@ -11119,29 +11256,30 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['7b052415'] = {"dfnID": "7b052415", "url": "https://webidl.spec.whatwg.org/#dfn-json-types", "dfnText": "json type", "refSections": [{"refs": [{"id": "ref-for-dfn-json-types"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dfn-json-types\u2460"}, {"id": "ref-for-dfn-json-types\u2461"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-json-types\u2462"}, {"id": "ref-for-dfn-json-types\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
 window.dfnpanelData['f8de33a3'] = {"dfnID": "f8de33a3", "url": "https://webidl.spec.whatwg.org/#idl-long", "dfnText": "long", "refSections": [{"refs": [{"id": "ref-for-idl-long"}], "title": "5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}], "external": true};
 window.dfnpanelData['9aeb0a82'] = {"dfnID": "9aeb0a82", "url": "https://webidl.spec.whatwg.org/#idl-long-long", "dfnText": "long long", "refSections": [{"refs": [{"id": "ref-for-idl-long-long"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
+window.dfnpanelData['efd1ec5d'] = {"dfnID": "efd1ec5d", "url": "https://webidl.spec.whatwg.org/#idl-object", "dfnText": "object", "refSections": [{"refs": [{"id": "ref-for-idl-object"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['7787d359'] = {"dfnID": "7787d359", "url": "https://webidl.spec.whatwg.org/#idl-record", "dfnText": "record", "refSections": [{"refs": [{"id": "ref-for-idl-record"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
-window.dfnpanelData['9cce47fd'] = {"dfnID": "9cce47fd", "url": "https://webidl.spec.whatwg.org/#idl-sequence", "dfnText": "sequence", "refSections": [{"refs": [{"id": "ref-for-idl-sequence"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-sequence\u2460"}, {"id": "ref-for-idl-sequence\u2461"}, {"id": "ref-for-idl-sequence\u2462"}, {"id": "ref-for-idl-sequence\u2463"}, {"id": "ref-for-idl-sequence\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-sequence\u2465"}, {"id": "ref-for-idl-sequence\u2466"}, {"id": "ref-for-idl-sequence\u2467"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-sequence\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u24ea"}, {"id": "ref-for-idl-sequence\u2460\u2460"}, {"id": "ref-for-idl-sequence\u2460\u2461"}, {"id": "ref-for-idl-sequence\u2460\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2463"}, {"id": "ref-for-idl-sequence\u2460\u2464"}, {"id": "ref-for-idl-sequence\u2460\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2466"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2467"}, {"id": "ref-for-idl-sequence\u2460\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-idl-sequence\u2461\u24ea"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['9cce47fd'] = {"dfnID": "9cce47fd", "url": "https://webidl.spec.whatwg.org/#idl-sequence", "dfnText": "sequence", "refSections": [{"refs": [{"id": "ref-for-idl-sequence"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-sequence\u2460"}, {"id": "ref-for-idl-sequence\u2461"}, {"id": "ref-for-idl-sequence\u2462"}, {"id": "ref-for-idl-sequence\u2463"}, {"id": "ref-for-idl-sequence\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-sequence\u2465"}, {"id": "ref-for-idl-sequence\u2466"}, {"id": "ref-for-idl-sequence\u2467"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-sequence\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u24ea"}, {"id": "ref-for-idl-sequence\u2460\u2460"}, {"id": "ref-for-idl-sequence\u2460\u2461"}, {"id": "ref-for-idl-sequence\u2460\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2463"}, {"id": "ref-for-idl-sequence\u2460\u2464"}, {"id": "ref-for-idl-sequence\u2460\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2466"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2467"}, {"id": "ref-for-idl-sequence\u2460\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-idl-sequence\u2461\u24ea"}, {"id": "ref-for-idl-sequence\u2461\u2460"}, {"id": "ref-for-idl-sequence\u2461\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
 window.dfnpanelData['e97a9688'] = {"dfnID": "e97a9688", "url": "https://webidl.spec.whatwg.org/#idl-unsigned-long", "dfnText": "unsigned long", "refSections": [{"refs": [{"id": "ref-for-idl-unsigned-long"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2461"}, {"id": "ref-for-idl-unsigned-long\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2463"}, {"id": "ref-for-idl-unsigned-long\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2465"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
 window.dfnpanelData['81daedb9'] = {"dfnID": "81daedb9", "url": "https://html.spec.whatwg.org/#focus", "dfnText": "focus", "refSections": [{"refs": [{"id": "ref-for-focus"}], "title": "5.6. Abort Operations with AbortSignal"}], "external": true};
 window.dfnpanelData['base64url-encoding'] = {"dfnID": "base64url-encoding", "url": "#base64url-encoding", "dfnText": "Base64url Encoding", "refSections": [{"refs": [{"id": "ref-for-base64url-encoding"}, {"id": "ref-for-base64url-encoding\u2460"}, {"id": "ref-for-base64url-encoding\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-base64url-encoding\u2462"}, {"id": "ref-for-base64url-encoding\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2464"}, {"id": "ref-for-base64url-encoding\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2466"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-base64url-encoding\u2467"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u24ea"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2460"}], "title": "5.8.1.1. Serialization"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2461"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2462"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2464"}, {"id": "ref-for-base64url-encoding\u2460\u2465"}, {"id": "ref-for-base64url-encoding\u2460\u2466"}, {"id": "ref-for-base64url-encoding\u2460\u2467"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2468"}, {"id": "ref-for-base64url-encoding\u2461\u24ea"}, {"id": "ref-for-base64url-encoding\u2461\u2460"}, {"id": "ref-for-base64url-encoding\u2461\u2461"}, {"id": "ref-for-base64url-encoding\u2461\u2462"}, {"id": "ref-for-base64url-encoding\u2461\u2463"}, {"id": "ref-for-base64url-encoding\u2461\u2464"}, {"id": "ref-for-base64url-encoding\u2461\u2465"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['cbor'] = {"dfnID": "cbor", "url": "#cbor", "dfnText": "CBOR", "refSections": [{"refs": [{"id": "ref-for-cbor"}], "title": "2.4. All Conformance Classes"}, {"refs": [{"id": "ref-for-cbor\u2460"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-cbor\u2461"}, {"id": "ref-for-cbor\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-cbor\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-cbor\u2464"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-cbor\u2465"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-cbor\u2466"}, {"id": "ref-for-cbor\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-cbor\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-cbor\u2460\u24ea"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-cbor\u2460\u2460"}, {"id": "ref-for-cbor\u2460\u2461"}, {"id": "ref-for-cbor\u2460\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-cbor\u2460\u2463"}, {"id": "ref-for-cbor\u2460\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-cbor\u2460\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-cbor\u2460\u2466"}, {"id": "ref-for-cbor\u2460\u2467"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-cbor\u2460\u2468"}, {"id": "ref-for-cbor\u2461\u24ea"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-cbor\u2461\u2460"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['cddl'] = {"dfnID": "cddl", "url": "#cddl", "dfnText": "CDDL", "refSections": [{"refs": [{"id": "ref-for-cddl"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-cddl\u2460"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-cddl\u2461"}], "title": "9.3. Extending Request Parameters"}], "external": false};
-window.dfnpanelData['attestation'] = {"dfnID": "attestation", "url": "#attestation", "dfnText": "Attestation", "refSections": [{"refs": [{"id": "ref-for-attestation\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-attestation\u2462"}, {"id": "ref-for-attestation\u2463"}, {"id": "ref-for-attestation\u2464"}, {"id": "ref-for-attestation\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation\u2467"}, {"id": "ref-for-attestation\u2468"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-attestation\u2460\u24ea"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2462"}, {"id": "ref-for-attestation\u2460\u2463"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-attestation\u2460\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation\u2460\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation\u2460\u2466"}, {"id": "ref-for-attestation\u2460\u2467"}, {"id": "ref-for-attestation\u2460\u2468"}, {"id": "ref-for-attestation\u2461\u24ea"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation\u2461\u2460"}, {"id": "ref-for-attestation\u2461\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation\u2461\u2462"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2463"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation\u2461\u2465"}], "title": "12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-attestation\u2461\u2466"}], "title": "13. Security Considerations"}], "external": false};
+window.dfnpanelData['attestation'] = {"dfnID": "attestation", "url": "#attestation", "dfnText": "Attestation", "refSections": [{"refs": [{"id": "ref-for-attestation\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-attestation\u2462"}, {"id": "ref-for-attestation\u2463"}, {"id": "ref-for-attestation\u2464"}, {"id": "ref-for-attestation\u2465"}, {"id": "ref-for-attestation\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation\u2468"}, {"id": "ref-for-attestation\u2460\u24ea"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-attestation\u2460\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2463"}, {"id": "ref-for-attestation\u2460\u2464"}, {"id": "ref-for-attestation\u2460\u2465"}, {"id": "ref-for-attestation\u2460\u2466"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-attestation\u2460\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation\u2460\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation\u2461\u24ea"}, {"id": "ref-for-attestation\u2461\u2460"}, {"id": "ref-for-attestation\u2461\u2461"}, {"id": "ref-for-attestation\u2461\u2462"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation\u2461\u2463"}, {"id": "ref-for-attestation\u2461\u2464"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation\u2461\u2465"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2466"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2467"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-attestation\u2461\u2468"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation\u2462\u24ea"}], "title": "12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-attestation\u2462\u2460"}], "title": "13. Security Considerations"}], "external": false};
 window.dfnpanelData['attestation-certificate'] = {"dfnID": "attestation-certificate", "url": "#attestation-certificate", "dfnText": "Attestation Certificate", "refSections": [{"refs": [{"id": "ref-for-attestation-certificate"}, {"id": "ref-for-attestation-certificate\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-certificate\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation-certificate\u2462"}, {"id": "ref-for-attestation-certificate\u2463"}, {"id": "ref-for-attestation-certificate\u2464"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-certificate\u2465"}], "title": "8.3.1. TPM Attestation Statement Certificate Requirements"}, {"refs": [{"id": "ref-for-attestation-certificate\u2466"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-certificate\u2467"}], "title": "8.4.1. Android Key Attestation Statement Certificate Requirements"}, {"refs": [{"id": "ref-for-attestation-certificate\u2468"}, {"id": "ref-for-attestation-certificate\u2460\u24ea"}, {"id": "ref-for-attestation-certificate\u2460\u2460"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-attestation-certificate\u2460\u2461"}, {"id": "ref-for-attestation-certificate\u2460\u2462"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-attestation-certificate\u2460\u2463"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-attestation-certificate\u2460\u2464"}, {"id": "ref-for-attestation-certificate\u2460\u2465"}, {"id": "ref-for-attestation-certificate\u2460\u2466"}, {"id": "ref-for-attestation-certificate\u2460\u2467"}, {"id": "ref-for-attestation-certificate\u2460\u2468"}, {"id": "ref-for-attestation-certificate\u2461\u24ea"}, {"id": "ref-for-attestation-certificate\u2461\u2460"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['attestation-key-pair'] = {"dfnID": "attestation-key-pair", "url": "#attestation-key-pair", "dfnText": "attestation key pair", "refSections": [{"refs": [{"id": "ref-for-attestation-key-pair"}, {"id": "ref-for-attestation-key-pair\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-key-pair\u2461"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-key-pair\u2462"}, {"id": "ref-for-attestation-key-pair\u2463"}, {"id": "ref-for-attestation-key-pair\u2464"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-key-pair\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-attestation-key-pair\u2466"}, {"id": "ref-for-attestation-key-pair\u2467"}, {"id": "ref-for-attestation-key-pair\u2468"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['attestation-private-key'] = {"dfnID": "attestation-private-key", "url": "#attestation-private-key", "dfnText": "attestation private key", "refSections": [{"refs": [{"id": "ref-for-attestation-private-key"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-attestation-private-key\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-private-key\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-private-key\u2462"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-private-key\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-private-key\u2464"}, {"id": "ref-for-attestation-private-key\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-attestation-private-key\u2466"}, {"id": "ref-for-attestation-private-key\u2467"}, {"id": "ref-for-attestation-private-key\u2468"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['attestation-public-key'] = {"dfnID": "attestation-public-key", "url": "#attestation-public-key", "dfnText": "attestation public key", "refSections": [{"refs": [{"id": "ref-for-attestation-public-key"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-public-key\u2460"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}], "external": false};
 window.dfnpanelData['authentication'] = {"dfnID": "authentication", "url": "#authentication", "dfnText": "Authentication", "refSections": [{"refs": [{"id": "ref-for-authentication"}, {"id": "ref-for-authentication\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-authentication\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-authentication\u2462"}, {"id": "ref-for-authentication\u2463"}, {"id": "ref-for-authentication\u2464"}, {"id": "ref-for-authentication\u2465"}, {"id": "ref-for-authentication\u2466"}, {"id": "ref-for-authentication\u2467"}, {"id": "ref-for-authentication\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authentication\u2460\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-authentication\u2460\u2460"}, {"id": "ref-for-authentication\u2460\u2461"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-authentication\u2460\u2462"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-authentication\u2460\u2463"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authentication\u2460\u2464"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-authentication\u2460\u2465"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-authentication\u2460\u2466"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-authentication\u2460\u2467"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-authentication\u2460\u2468"}], "title": "16. Acknowledgements"}], "external": false};
-window.dfnpanelData['authentication-ceremony'] = {"dfnID": "authentication-ceremony", "url": "#authentication-ceremony", "dfnText": "Authentication Ceremony", "refSections": [{"refs": [{"id": "ref-for-authentication-ceremony"}, {"id": "ref-for-authentication-ceremony\u2460"}, {"id": "ref-for-authentication-ceremony\u2461"}, {"id": "ref-for-authentication-ceremony\u2462"}, {"id": "ref-for-authentication-ceremony\u2463"}, {"id": "ref-for-authentication-ceremony\u2464"}, {"id": "ref-for-authentication-ceremony\u2465"}, {"id": "ref-for-authentication-ceremony\u2466"}, {"id": "ref-for-authentication-ceremony\u2467"}, {"id": "ref-for-authentication-ceremony\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2462"}, {"id": "ref-for-authentication-ceremony\u2460\u2463"}, {"id": "ref-for-authentication-ceremony\u2460\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2466"}, {"id": "ref-for-authentication-ceremony\u2460\u2467"}, {"id": "ref-for-authentication-ceremony\u2460\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2460"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2461"}, {"id": "ref-for-authentication-ceremony\u2461\u2462"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2463"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2464"}, {"id": "ref-for-authentication-ceremony\u2461\u2465"}, {"id": "ref-for-authentication-ceremony\u2461\u2466"}, {"id": "ref-for-authentication-ceremony\u2461\u2467"}, {"id": "ref-for-authentication-ceremony\u2461\u2468"}, {"id": "ref-for-authentication-ceremony\u2462\u24ea"}, {"id": "ref-for-authentication-ceremony\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2461"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2462"}, {"id": "ref-for-authentication-ceremony\u2462\u2463"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2464"}, {"id": "ref-for-authentication-ceremony\u2462\u2465"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2466"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2467"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2468"}, {"id": "ref-for-authentication-ceremony\u2463\u24ea"}, {"id": "ref-for-authentication-ceremony\u2463\u2460"}, {"id": "ref-for-authentication-ceremony\u2463\u2461"}, {"id": "ref-for-authentication-ceremony\u2463\u2462"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u2463"}, {"id": "ref-for-authentication-ceremony\u2463\u2464"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u2465"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['authentication-ceremony'] = {"dfnID": "authentication-ceremony", "url": "#authentication-ceremony", "dfnText": "Authentication Ceremony", "refSections": [{"refs": [{"id": "ref-for-authentication-ceremony"}, {"id": "ref-for-authentication-ceremony\u2460"}, {"id": "ref-for-authentication-ceremony\u2461"}, {"id": "ref-for-authentication-ceremony\u2462"}, {"id": "ref-for-authentication-ceremony\u2463"}, {"id": "ref-for-authentication-ceremony\u2464"}, {"id": "ref-for-authentication-ceremony\u2465"}, {"id": "ref-for-authentication-ceremony\u2466"}, {"id": "ref-for-authentication-ceremony\u2467"}, {"id": "ref-for-authentication-ceremony\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2462"}, {"id": "ref-for-authentication-ceremony\u2460\u2463"}, {"id": "ref-for-authentication-ceremony\u2460\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2460\u2466"}, {"id": "ref-for-authentication-ceremony\u2460\u2467"}, {"id": "ref-for-authentication-ceremony\u2460\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2460"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2461"}, {"id": "ref-for-authentication-ceremony\u2461\u2462"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2463"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2461\u2464"}, {"id": "ref-for-authentication-ceremony\u2461\u2465"}, {"id": "ref-for-authentication-ceremony\u2461\u2466"}, {"id": "ref-for-authentication-ceremony\u2461\u2467"}, {"id": "ref-for-authentication-ceremony\u2461\u2468"}, {"id": "ref-for-authentication-ceremony\u2462\u24ea"}, {"id": "ref-for-authentication-ceremony\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2461"}, {"id": "ref-for-authentication-ceremony\u2462\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2463"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2464"}, {"id": "ref-for-authentication-ceremony\u2462\u2465"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2466"}, {"id": "ref-for-authentication-ceremony\u2462\u2467"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2462\u2468"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u24ea"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u2460"}, {"id": "ref-for-authentication-ceremony\u2463\u2461"}, {"id": "ref-for-authentication-ceremony\u2463\u2462"}, {"id": "ref-for-authentication-ceremony\u2463\u2463"}, {"id": "ref-for-authentication-ceremony\u2463\u2464"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u2465"}, {"id": "ref-for-authentication-ceremony\u2463\u2466"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-authentication-ceremony\u2463\u2467"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
 window.dfnpanelData['authentication-assertion'] = {"dfnID": "authentication-assertion", "url": "#authentication-assertion", "dfnText": "Authentication Assertion", "refSections": [{"refs": [{"id": "ref-for-authentication-assertion"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460"}, {"id": "ref-for-authentication-assertion\u2461"}, {"id": "ref-for-authentication-assertion\u2462"}, {"id": "ref-for-authentication-assertion\u2463"}, {"id": "ref-for-authentication-assertion\u2464"}, {"id": "ref-for-authentication-assertion\u2465"}, {"id": "ref-for-authentication-assertion\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authentication-assertion\u2467"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authentication-assertion\u2468"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u24ea"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2460"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2463"}, {"id": "ref-for-authentication-assertion\u2460\u2464"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2465"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-authentication-assertion\u2460\u2466"}], "title": "13.4.8. Code injection attacks"}], "external": false};
-window.dfnpanelData['assertion'] = {"dfnID": "assertion", "url": "#assertion", "dfnText": "Assertion", "refSections": [{"refs": [{"id": "ref-for-assertion"}, {"id": "ref-for-assertion\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-assertion\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-assertion\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-assertion\u2463"}, {"id": "ref-for-assertion\u2464"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-assertion\u2465"}, {"id": "ref-for-assertion\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-assertion\u2467"}, {"id": "ref-for-assertion\u2468"}, {"id": "ref-for-assertion\u2460\u24ea"}, {"id": "ref-for-assertion\u2460\u2460"}, {"id": "ref-for-assertion\u2460\u2461"}, {"id": "ref-for-assertion\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-assertion\u2460\u2463"}, {"id": "ref-for-assertion\u2460\u2464"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-assertion\u2460\u2465"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-assertion\u2460\u2466"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-assertion\u2460\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
-window.dfnpanelData['authenticator'] = {"dfnID": "authenticator", "url": "#authenticator", "dfnText": "Authenticator", "refSections": [{"refs": [{"id": "ref-for-authenticator\u2464"}, {"id": "ref-for-authenticator\u2465"}, {"id": "ref-for-authenticator\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-authenticator\u2467"}, {"id": "ref-for-authenticator\u2468"}, {"id": "ref-for-authenticator\u2460\u24ea"}, {"id": "ref-for-authenticator\u2460\u2460"}, {"id": "ref-for-authenticator\u2460\u2461"}, {"id": "ref-for-authenticator\u2460\u2462"}, {"id": "ref-for-authenticator\u2460\u2463"}, {"id": "ref-for-authenticator\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2465"}], "title": "1.2. Use Cases"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2466"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467"}, {"id": "ref-for-authenticator\u2460\u2468"}, {"id": "ref-for-authenticator\u2461\u24ea"}, {"id": "ref-for-authenticator\u2461\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461"}], "title": "2.2.1. Backwards Compatibility with FIDO U2F"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462"}, {"id": "ref-for-authenticator\u2461\u2463"}, {"id": "ref-for-authenticator\u2461\u2464"}, {"id": "ref-for-authenticator\u2461\u2465"}, {"id": "ref-for-authenticator\u2461\u2466"}, {"id": "ref-for-authenticator\u2461\u2467"}, {"id": "ref-for-authenticator\u2461\u2468"}, {"id": "ref-for-authenticator\u2462\u24ea"}, {"id": "ref-for-authenticator\u2462\u2460"}, {"id": "ref-for-authenticator\u2462\u2461"}, {"id": "ref-for-authenticator\u2462\u2462"}, {"id": "ref-for-authenticator\u2462\u2463"}, {"id": "ref-for-authenticator\u2462\u2464"}, {"id": "ref-for-authenticator\u2462\u2465"}, {"id": "ref-for-authenticator\u2462\u2466"}, {"id": "ref-for-authenticator\u2462\u2467"}, {"id": "ref-for-authenticator\u2462\u2468"}, {"id": "ref-for-authenticator\u2463\u24ea"}, {"id": "ref-for-authenticator\u2463\u2460"}, {"id": "ref-for-authenticator\u2463\u2461"}, {"id": "ref-for-authenticator\u2463\u2462"}, {"id": "ref-for-authenticator\u2463\u2463"}, {"id": "ref-for-authenticator\u2463\u2464"}, {"id": "ref-for-authenticator\u2463\u2465"}, {"id": "ref-for-authenticator\u2463\u2466"}, {"id": "ref-for-authenticator\u2463\u2467"}, {"id": "ref-for-authenticator\u2463\u2468"}, {"id": "ref-for-authenticator\u2464\u24ea"}, {"id": "ref-for-authenticator\u2464\u2460"}, {"id": "ref-for-authenticator\u2464\u2461"}, {"id": "ref-for-authenticator\u2464\u2462"}, {"id": "ref-for-authenticator\u2464\u2463"}, {"id": "ref-for-authenticator\u2464\u2464"}, {"id": "ref-for-authenticator\u2464\u2465"}, {"id": "ref-for-authenticator\u2464\u2466"}, {"id": "ref-for-authenticator\u2464\u2467"}, {"id": "ref-for-authenticator\u2464\u2468"}, {"id": "ref-for-authenticator\u2465\u24ea"}, {"id": "ref-for-authenticator\u2465\u2460"}, {"id": "ref-for-authenticator\u2465\u2461"}, {"id": "ref-for-authenticator\u2465\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator\u2465\u2463"}, {"id": "ref-for-authenticator\u2465\u2464"}, {"id": "ref-for-authenticator\u2465\u2465"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-authenticator\u2465\u2466"}, {"id": "ref-for-authenticator\u2465\u2467"}, {"id": "ref-for-authenticator\u2465\u2468"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authenticator\u2466\u24ea"}, {"id": "ref-for-authenticator\u2466\u2460"}, {"id": "ref-for-authenticator\u2466\u2461"}, {"id": "ref-for-authenticator\u2466\u2462"}, {"id": "ref-for-authenticator\u2466\u2463"}, {"id": "ref-for-authenticator\u2466\u2464"}, {"id": "ref-for-authenticator\u2466\u2465"}, {"id": "ref-for-authenticator\u2466\u2466"}, {"id": "ref-for-authenticator\u2466\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator\u2466\u2468"}, {"id": "ref-for-authenticator\u2467\u24ea"}, {"id": "ref-for-authenticator\u2467\u2460"}, {"id": "ref-for-authenticator\u2467\u2461"}, {"id": "ref-for-authenticator\u2467\u2462"}, {"id": "ref-for-authenticator\u2467\u2463"}, {"id": "ref-for-authenticator\u2467\u2464"}, {"id": "ref-for-authenticator\u2467\u2465"}, {"id": "ref-for-authenticator\u2467\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator\u2467\u2467"}, {"id": "ref-for-authenticator\u2467\u2468"}, {"id": "ref-for-authenticator\u2468\u24ea"}, {"id": "ref-for-authenticator\u2468\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2461"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2462"}, {"id": "ref-for-authenticator\u2468\u2463"}, {"id": "ref-for-authenticator\u2468\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2465"}, {"id": "ref-for-authenticator\u2468\u2466"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2467"}, {"id": "ref-for-authenticator\u2468\u2468"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2460\u24ea\u2460"}, {"id": "ref-for-authenticator\u2460\u24ea\u2461"}, {"id": "ref-for-authenticator\u2460\u24ea\u2462"}, {"id": "ref-for-authenticator\u2460\u24ea\u2463"}, {"id": "ref-for-authenticator\u2460\u24ea\u2464"}, {"id": "ref-for-authenticator\u2460\u24ea\u2465"}, {"id": "ref-for-authenticator\u2460\u24ea\u2466"}, {"id": "ref-for-authenticator\u2460\u24ea\u2467"}, {"id": "ref-for-authenticator\u2460\u24ea\u2468"}, {"id": "ref-for-authenticator\u2460\u2460\u24ea"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2460"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2461"}, {"id": "ref-for-authenticator\u2460\u2460\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2465"}, {"id": "ref-for-authenticator\u2460\u2460\u2466"}, {"id": "ref-for-authenticator\u2460\u2460\u2467"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2468"}, {"id": "ref-for-authenticator\u2460\u2461\u24ea"}, {"id": "ref-for-authenticator\u2460\u2461\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2461\u2461"}, {"id": "ref-for-authenticator\u2460\u2461\u2462"}, {"id": "ref-for-authenticator\u2460\u2461\u2463"}, {"id": "ref-for-authenticator\u2460\u2461\u2464"}, {"id": "ref-for-authenticator\u2460\u2461\u2465"}, {"id": "ref-for-authenticator\u2460\u2461\u2466"}, {"id": "ref-for-authenticator\u2460\u2461\u2467"}, {"id": "ref-for-authenticator\u2460\u2461\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u24ea"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u2461"}, {"id": "ref-for-authenticator\u2460\u2462\u2462"}, {"id": "ref-for-authenticator\u2460\u2462\u2463"}, {"id": "ref-for-authenticator\u2460\u2462\u2464"}, {"id": "ref-for-authenticator\u2460\u2462\u2465"}, {"id": "ref-for-authenticator\u2460\u2462\u2466"}, {"id": "ref-for-authenticator\u2460\u2462\u2467"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u2468"}, {"id": "ref-for-authenticator\u2460\u2463\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2463\u2460"}, {"id": "ref-for-authenticator\u2460\u2463\u2461"}, {"id": "ref-for-authenticator\u2460\u2463\u2462"}, {"id": "ref-for-authenticator\u2460\u2463\u2463"}, {"id": "ref-for-authenticator\u2460\u2463\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2463\u2465"}, {"id": "ref-for-authenticator\u2460\u2463\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2463\u2467"}, {"id": "ref-for-authenticator\u2460\u2463\u2468"}, {"id": "ref-for-authenticator\u2460\u2464\u24ea"}, {"id": "ref-for-authenticator\u2460\u2464\u2460"}, {"id": "ref-for-authenticator\u2460\u2464\u2461"}, {"id": "ref-for-authenticator\u2460\u2464\u2462"}, {"id": "ref-for-authenticator\u2460\u2464\u2463"}, {"id": "ref-for-authenticator\u2460\u2464\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2464\u2465"}, {"id": "ref-for-authenticator\u2460\u2464\u2466"}, {"id": "ref-for-authenticator\u2460\u2464\u2467"}, {"id": "ref-for-authenticator\u2460\u2464\u2468"}, {"id": "ref-for-authenticator\u2460\u2465\u24ea"}, {"id": "ref-for-authenticator\u2460\u2465\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2465\u2461"}, {"id": "ref-for-authenticator\u2460\u2465\u2462"}, {"id": "ref-for-authenticator\u2460\u2465\u2463"}, {"id": "ref-for-authenticator\u2460\u2465\u2464"}, {"id": "ref-for-authenticator\u2460\u2465\u2465"}, {"id": "ref-for-authenticator\u2460\u2465\u2466"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2465\u2467"}, {"id": "ref-for-authenticator\u2460\u2465\u2468"}, {"id": "ref-for-authenticator\u2460\u2466\u24ea"}, {"id": "ref-for-authenticator\u2460\u2466\u2460"}, {"id": "ref-for-authenticator\u2460\u2466\u2461"}, {"id": "ref-for-authenticator\u2460\u2466\u2462"}, {"id": "ref-for-authenticator\u2460\u2466\u2463"}, {"id": "ref-for-authenticator\u2460\u2466\u2464"}, {"id": "ref-for-authenticator\u2460\u2466\u2465"}, {"id": "ref-for-authenticator\u2460\u2466\u2466"}, {"id": "ref-for-authenticator\u2460\u2466\u2467"}, {"id": "ref-for-authenticator\u2460\u2466\u2468"}, {"id": "ref-for-authenticator\u2460\u2467\u24ea"}, {"id": "ref-for-authenticator\u2460\u2467\u2460"}, {"id": "ref-for-authenticator\u2460\u2467\u2461"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467\u2462"}, {"id": "ref-for-authenticator\u2460\u2467\u2463"}, {"id": "ref-for-authenticator\u2460\u2467\u2464"}, {"id": "ref-for-authenticator\u2460\u2467\u2465"}, {"id": "ref-for-authenticator\u2460\u2467\u2466"}, {"id": "ref-for-authenticator\u2460\u2467\u2467"}, {"id": "ref-for-authenticator\u2460\u2467\u2468"}, {"id": "ref-for-authenticator\u2460\u2468\u24ea"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2468\u2460"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2468\u2461"}, {"id": "ref-for-authenticator\u2460\u2468\u2462"}, {"id": "ref-for-authenticator\u2460\u2468\u2463"}, {"id": "ref-for-authenticator\u2460\u2468\u2464"}, {"id": "ref-for-authenticator\u2460\u2468\u2465"}, {"id": "ref-for-authenticator\u2460\u2468\u2466"}, {"id": "ref-for-authenticator\u2460\u2468\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2468\u2468"}, {"id": "ref-for-authenticator\u2461\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2461\u24ea\u2460"}, {"id": "ref-for-authenticator\u2461\u24ea\u2461"}, {"id": "ref-for-authenticator\u2461\u24ea\u2462"}, {"id": "ref-for-authenticator\u2461\u24ea\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2464"}, {"id": "ref-for-authenticator\u2461\u24ea\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2466"}, {"id": "ref-for-authenticator\u2461\u24ea\u2467"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2468"}], "title": "6.4.2. Language and Direction Encoding"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2460\u24ea"}, {"id": "ref-for-authenticator\u2461\u2460\u2460"}, {"id": "ref-for-authenticator\u2461\u2460\u2461"}, {"id": "ref-for-authenticator\u2461\u2460\u2462"}, {"id": "ref-for-authenticator\u2461\u2460\u2463"}, {"id": "ref-for-authenticator\u2461\u2460\u2464"}, {"id": "ref-for-authenticator\u2461\u2460\u2465"}, {"id": "ref-for-authenticator\u2461\u2460\u2466"}, {"id": "ref-for-authenticator\u2461\u2460\u2467"}, {"id": "ref-for-authenticator\u2461\u2460\u2468"}, {"id": "ref-for-authenticator\u2461\u2461\u24ea"}, {"id": "ref-for-authenticator\u2461\u2461\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2462"}, {"id": "ref-for-authenticator\u2461\u2461\u2463"}, {"id": "ref-for-authenticator\u2461\u2461\u2464"}, {"id": "ref-for-authenticator\u2461\u2461\u2465"}, {"id": "ref-for-authenticator\u2461\u2461\u2466"}, {"id": "ref-for-authenticator\u2461\u2461\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2468"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u24ea"}, {"id": "ref-for-authenticator\u2461\u2462\u2460"}], "title": "6.5.6. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2461"}, {"id": "ref-for-authenticator\u2461\u2462\u2462"}, {"id": "ref-for-authenticator\u2461\u2462\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2465"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2466"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2467"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2468"}, {"id": "ref-for-authenticator\u2461\u2463\u24ea"}, {"id": "ref-for-authenticator\u2461\u2463\u2460"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2461"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2463"}, {"id": "ref-for-authenticator\u2461\u2463\u2464"}, {"id": "ref-for-authenticator\u2461\u2463\u2465"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2466"}, {"id": "ref-for-authenticator\u2461\u2463\u2467"}, {"id": "ref-for-authenticator\u2461\u2463\u2468"}, {"id": "ref-for-authenticator\u2461\u2464\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2461"}, {"id": "ref-for-authenticator\u2461\u2464\u2462"}, {"id": "ref-for-authenticator\u2461\u2464\u2463"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2464"}, {"id": "ref-for-authenticator\u2461\u2464\u2465"}, {"id": "ref-for-authenticator\u2461\u2464\u2466"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2467"}, {"id": "ref-for-authenticator\u2461\u2464\u2468"}, {"id": "ref-for-authenticator\u2461\u2465\u24ea"}, {"id": "ref-for-authenticator\u2461\u2465\u2460"}, {"id": "ref-for-authenticator\u2461\u2465\u2461"}, {"id": "ref-for-authenticator\u2461\u2465\u2462"}, {"id": "ref-for-authenticator\u2461\u2465\u2463"}, {"id": "ref-for-authenticator\u2461\u2465\u2464"}, {"id": "ref-for-authenticator\u2461\u2465\u2465"}, {"id": "ref-for-authenticator\u2461\u2465\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2465\u2467"}, {"id": "ref-for-authenticator\u2461\u2465\u2468"}, {"id": "ref-for-authenticator\u2461\u2466\u24ea"}, {"id": "ref-for-authenticator\u2461\u2466\u2460"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2466\u2461"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2466\u2462"}, {"id": "ref-for-authenticator\u2461\u2466\u2463"}, {"id": "ref-for-authenticator\u2461\u2466\u2464"}, {"id": "ref-for-authenticator\u2461\u2466\u2465"}, {"id": "ref-for-authenticator\u2461\u2466\u2466"}, {"id": "ref-for-authenticator\u2461\u2466\u2467"}, {"id": "ref-for-authenticator\u2461\u2466\u2468"}, {"id": "ref-for-authenticator\u2461\u2467\u24ea"}, {"id": "ref-for-authenticator\u2461\u2467\u2460"}, {"id": "ref-for-authenticator\u2461\u2467\u2461"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2462"}], "title": "13.3. Security considerations for authenticators "}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2463"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2464"}, {"id": "ref-for-authenticator\u2461\u2467\u2465"}, {"id": "ref-for-authenticator\u2461\u2467\u2466"}, {"id": "ref-for-authenticator\u2461\u2467\u2467"}, {"id": "ref-for-authenticator\u2461\u2467\u2468"}, {"id": "ref-for-authenticator\u2461\u2468\u24ea"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2468\u2460"}, {"id": "ref-for-authenticator\u2461\u2468\u2461"}, {"id": "ref-for-authenticator\u2461\u2468\u2462"}, {"id": "ref-for-authenticator\u2461\u2468\u2463"}, {"id": "ref-for-authenticator\u2461\u2468\u2464"}, {"id": "ref-for-authenticator\u2461\u2468\u2465"}, {"id": "ref-for-authenticator\u2461\u2468\u2466"}, {"id": "ref-for-authenticator\u2461\u2468\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2468\u2468"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2462\u24ea\u2460"}, {"id": "ref-for-authenticator\u2462\u24ea\u2461"}, {"id": "ref-for-authenticator\u2462\u24ea\u2462"}, {"id": "ref-for-authenticator\u2462\u24ea\u2463"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2464"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2465"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2466"}, {"id": "ref-for-authenticator\u2462\u24ea\u2467"}, {"id": "ref-for-authenticator\u2462\u24ea\u2468"}, {"id": "ref-for-authenticator\u2462\u2460\u24ea"}, {"id": "ref-for-authenticator\u2462\u2460\u2460"}, {"id": "ref-for-authenticator\u2462\u2460\u2461"}, {"id": "ref-for-authenticator\u2462\u2460\u2462"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2460\u2463"}, {"id": "ref-for-authenticator\u2462\u2460\u2464"}, {"id": "ref-for-authenticator\u2462\u2460\u2465"}, {"id": "ref-for-authenticator\u2462\u2460\u2466"}, {"id": "ref-for-authenticator\u2462\u2460\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2460\u2468"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2461\u24ea"}], "title": "14.4. Privacy considerations for authenticators"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2461\u2460"}, {"id": "ref-for-authenticator\u2462\u2461\u2461"}, {"id": "ref-for-authenticator\u2462\u2461\u2462"}, {"id": "ref-for-authenticator\u2462\u2461\u2463"}, {"id": "ref-for-authenticator\u2462\u2461\u2464"}], "title": "14.4.1. Attestation Privacy"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2461\u2465"}, {"id": "ref-for-authenticator\u2462\u2461\u2466"}, {"id": "ref-for-authenticator\u2462\u2461\u2467"}, {"id": "ref-for-authenticator\u2462\u2461\u2468"}, {"id": "ref-for-authenticator\u2462\u2462\u24ea"}, {"id": "ref-for-authenticator\u2462\u2462\u2460"}, {"id": "ref-for-authenticator\u2462\u2462\u2461"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2462\u2462"}, {"id": "ref-for-authenticator\u2462\u2462\u2463"}, {"id": "ref-for-authenticator\u2462\u2462\u2464"}, {"id": "ref-for-authenticator\u2462\u2462\u2465"}, {"id": "ref-for-authenticator\u2462\u2462\u2466"}, {"id": "ref-for-authenticator\u2462\u2462\u2467"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2462\u2468"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2463\u24ea"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2463\u2460"}, {"id": "ref-for-authenticator\u2462\u2463\u2461"}, {"id": "ref-for-authenticator\u2462\u2463\u2462"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2463\u2463"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['assertion'] = {"dfnID": "assertion", "url": "#assertion", "dfnText": "Assertion", "refSections": [{"refs": [{"id": "ref-for-assertion"}, {"id": "ref-for-assertion\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-assertion\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-assertion\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-assertion\u2463"}, {"id": "ref-for-assertion\u2464"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-assertion\u2465"}, {"id": "ref-for-assertion\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-assertion\u2467"}, {"id": "ref-for-assertion\u2468"}, {"id": "ref-for-assertion\u2460\u24ea"}, {"id": "ref-for-assertion\u2460\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-assertion\u2460\u2461"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-assertion\u2460\u2462"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-assertion\u2460\u2463"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-assertion\u2460\u2464"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
+window.dfnpanelData['authenticator'] = {"dfnID": "authenticator", "url": "#authenticator", "dfnText": "Authenticator", "refSections": [{"refs": [{"id": "ref-for-authenticator\u2464"}, {"id": "ref-for-authenticator\u2465"}, {"id": "ref-for-authenticator\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-authenticator\u2467"}, {"id": "ref-for-authenticator\u2468"}, {"id": "ref-for-authenticator\u2460\u24ea"}, {"id": "ref-for-authenticator\u2460\u2460"}, {"id": "ref-for-authenticator\u2460\u2461"}, {"id": "ref-for-authenticator\u2460\u2462"}, {"id": "ref-for-authenticator\u2460\u2463"}, {"id": "ref-for-authenticator\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2465"}], "title": "1.2. Use Cases"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2466"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467"}, {"id": "ref-for-authenticator\u2460\u2468"}, {"id": "ref-for-authenticator\u2461\u24ea"}, {"id": "ref-for-authenticator\u2461\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461"}], "title": "2.2.1. Backwards Compatibility with FIDO U2F"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462"}, {"id": "ref-for-authenticator\u2461\u2463"}, {"id": "ref-for-authenticator\u2461\u2464"}, {"id": "ref-for-authenticator\u2461\u2465"}, {"id": "ref-for-authenticator\u2461\u2466"}, {"id": "ref-for-authenticator\u2461\u2467"}, {"id": "ref-for-authenticator\u2461\u2468"}, {"id": "ref-for-authenticator\u2462\u24ea"}, {"id": "ref-for-authenticator\u2462\u2460"}, {"id": "ref-for-authenticator\u2462\u2461"}, {"id": "ref-for-authenticator\u2462\u2462"}, {"id": "ref-for-authenticator\u2462\u2463"}, {"id": "ref-for-authenticator\u2462\u2464"}, {"id": "ref-for-authenticator\u2462\u2465"}, {"id": "ref-for-authenticator\u2462\u2466"}, {"id": "ref-for-authenticator\u2462\u2467"}, {"id": "ref-for-authenticator\u2462\u2468"}, {"id": "ref-for-authenticator\u2463\u24ea"}, {"id": "ref-for-authenticator\u2463\u2460"}, {"id": "ref-for-authenticator\u2463\u2461"}, {"id": "ref-for-authenticator\u2463\u2462"}, {"id": "ref-for-authenticator\u2463\u2463"}, {"id": "ref-for-authenticator\u2463\u2464"}, {"id": "ref-for-authenticator\u2463\u2465"}, {"id": "ref-for-authenticator\u2463\u2466"}, {"id": "ref-for-authenticator\u2463\u2467"}, {"id": "ref-for-authenticator\u2463\u2468"}, {"id": "ref-for-authenticator\u2464\u24ea"}, {"id": "ref-for-authenticator\u2464\u2460"}, {"id": "ref-for-authenticator\u2464\u2461"}, {"id": "ref-for-authenticator\u2464\u2462"}, {"id": "ref-for-authenticator\u2464\u2463"}, {"id": "ref-for-authenticator\u2464\u2464"}, {"id": "ref-for-authenticator\u2464\u2465"}, {"id": "ref-for-authenticator\u2464\u2466"}, {"id": "ref-for-authenticator\u2464\u2467"}, {"id": "ref-for-authenticator\u2464\u2468"}, {"id": "ref-for-authenticator\u2465\u24ea"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator\u2465\u2460"}, {"id": "ref-for-authenticator\u2465\u2461"}, {"id": "ref-for-authenticator\u2465\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-authenticator\u2465\u2463"}, {"id": "ref-for-authenticator\u2465\u2464"}, {"id": "ref-for-authenticator\u2465\u2465"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authenticator\u2465\u2466"}, {"id": "ref-for-authenticator\u2465\u2467"}, {"id": "ref-for-authenticator\u2465\u2468"}, {"id": "ref-for-authenticator\u2466\u24ea"}, {"id": "ref-for-authenticator\u2466\u2460"}, {"id": "ref-for-authenticator\u2466\u2461"}, {"id": "ref-for-authenticator\u2466\u2462"}, {"id": "ref-for-authenticator\u2466\u2463"}, {"id": "ref-for-authenticator\u2466\u2464"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator\u2466\u2465"}, {"id": "ref-for-authenticator\u2466\u2466"}, {"id": "ref-for-authenticator\u2466\u2467"}, {"id": "ref-for-authenticator\u2466\u2468"}, {"id": "ref-for-authenticator\u2467\u24ea"}, {"id": "ref-for-authenticator\u2467\u2460"}, {"id": "ref-for-authenticator\u2467\u2461"}, {"id": "ref-for-authenticator\u2467\u2462"}, {"id": "ref-for-authenticator\u2467\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator\u2467\u2464"}, {"id": "ref-for-authenticator\u2467\u2465"}, {"id": "ref-for-authenticator\u2467\u2466"}, {"id": "ref-for-authenticator\u2467\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authenticator\u2467\u2468"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2468\u24ea"}, {"id": "ref-for-authenticator\u2468\u2460"}, {"id": "ref-for-authenticator\u2468\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2462"}, {"id": "ref-for-authenticator\u2468\u2463"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2464"}, {"id": "ref-for-authenticator\u2468\u2465"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authenticator\u2468\u2466"}, {"id": "ref-for-authenticator\u2468\u2467"}, {"id": "ref-for-authenticator\u2468\u2468"}, {"id": "ref-for-authenticator\u2460\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2460\u24ea\u2460"}, {"id": "ref-for-authenticator\u2460\u24ea\u2461"}, {"id": "ref-for-authenticator\u2460\u24ea\u2462"}, {"id": "ref-for-authenticator\u2460\u24ea\u2463"}, {"id": "ref-for-authenticator\u2460\u24ea\u2464"}, {"id": "ref-for-authenticator\u2460\u24ea\u2465"}, {"id": "ref-for-authenticator\u2460\u24ea\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u24ea\u2467"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u24ea\u2468"}, {"id": "ref-for-authenticator\u2460\u2460\u24ea"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2461"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2462"}, {"id": "ref-for-authenticator\u2460\u2460\u2463"}, {"id": "ref-for-authenticator\u2460\u2460\u2464"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2465"}, {"id": "ref-for-authenticator\u2460\u2460\u2466"}, {"id": "ref-for-authenticator\u2460\u2460\u2467"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2460\u2468"}, {"id": "ref-for-authenticator\u2460\u2461\u24ea"}, {"id": "ref-for-authenticator\u2460\u2461\u2460"}, {"id": "ref-for-authenticator\u2460\u2461\u2461"}, {"id": "ref-for-authenticator\u2460\u2461\u2462"}, {"id": "ref-for-authenticator\u2460\u2461\u2463"}, {"id": "ref-for-authenticator\u2460\u2461\u2464"}, {"id": "ref-for-authenticator\u2460\u2461\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2461\u2466"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2461\u2467"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2461\u2468"}, {"id": "ref-for-authenticator\u2460\u2462\u24ea"}, {"id": "ref-for-authenticator\u2460\u2462\u2460"}, {"id": "ref-for-authenticator\u2460\u2462\u2461"}, {"id": "ref-for-authenticator\u2460\u2462\u2462"}, {"id": "ref-for-authenticator\u2460\u2462\u2463"}, {"id": "ref-for-authenticator\u2460\u2462\u2464"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u2465"}, {"id": "ref-for-authenticator\u2460\u2462\u2466"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2462\u2467"}, {"id": "ref-for-authenticator\u2460\u2462\u2468"}, {"id": "ref-for-authenticator\u2460\u2463\u24ea"}, {"id": "ref-for-authenticator\u2460\u2463\u2460"}, {"id": "ref-for-authenticator\u2460\u2463\u2461"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2463\u2462"}, {"id": "ref-for-authenticator\u2460\u2463\u2463"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2463\u2464"}, {"id": "ref-for-authenticator\u2460\u2463\u2465"}, {"id": "ref-for-authenticator\u2460\u2463\u2466"}, {"id": "ref-for-authenticator\u2460\u2463\u2467"}, {"id": "ref-for-authenticator\u2460\u2463\u2468"}, {"id": "ref-for-authenticator\u2460\u2464\u24ea"}, {"id": "ref-for-authenticator\u2460\u2464\u2460"}, {"id": "ref-for-authenticator\u2460\u2464\u2461"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2464\u2462"}, {"id": "ref-for-authenticator\u2460\u2464\u2463"}, {"id": "ref-for-authenticator\u2460\u2464\u2464"}, {"id": "ref-for-authenticator\u2460\u2464\u2465"}, {"id": "ref-for-authenticator\u2460\u2464\u2466"}, {"id": "ref-for-authenticator\u2460\u2464\u2467"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2464\u2468"}, {"id": "ref-for-authenticator\u2460\u2465\u24ea"}, {"id": "ref-for-authenticator\u2460\u2465\u2460"}, {"id": "ref-for-authenticator\u2460\u2465\u2461"}, {"id": "ref-for-authenticator\u2460\u2465\u2462"}, {"id": "ref-for-authenticator\u2460\u2465\u2463"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2465\u2464"}, {"id": "ref-for-authenticator\u2460\u2465\u2465"}, {"id": "ref-for-authenticator\u2460\u2465\u2466"}, {"id": "ref-for-authenticator\u2460\u2465\u2467"}, {"id": "ref-for-authenticator\u2460\u2465\u2468"}, {"id": "ref-for-authenticator\u2460\u2466\u24ea"}, {"id": "ref-for-authenticator\u2460\u2466\u2460"}, {"id": "ref-for-authenticator\u2460\u2466\u2461"}, {"id": "ref-for-authenticator\u2460\u2466\u2462"}, {"id": "ref-for-authenticator\u2460\u2466\u2463"}, {"id": "ref-for-authenticator\u2460\u2466\u2464"}, {"id": "ref-for-authenticator\u2460\u2466\u2465"}, {"id": "ref-for-authenticator\u2460\u2466\u2466"}, {"id": "ref-for-authenticator\u2460\u2466\u2467"}, {"id": "ref-for-authenticator\u2460\u2466\u2468"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467\u24ea"}, {"id": "ref-for-authenticator\u2460\u2467\u2460"}, {"id": "ref-for-authenticator\u2460\u2467\u2461"}, {"id": "ref-for-authenticator\u2460\u2467\u2462"}, {"id": "ref-for-authenticator\u2460\u2467\u2463"}, {"id": "ref-for-authenticator\u2460\u2467\u2464"}, {"id": "ref-for-authenticator\u2460\u2467\u2465"}, {"id": "ref-for-authenticator\u2460\u2467\u2466"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467\u2467"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2467\u2468"}, {"id": "ref-for-authenticator\u2460\u2468\u24ea"}, {"id": "ref-for-authenticator\u2460\u2468\u2460"}, {"id": "ref-for-authenticator\u2460\u2468\u2461"}, {"id": "ref-for-authenticator\u2460\u2468\u2462"}, {"id": "ref-for-authenticator\u2460\u2468\u2463"}, {"id": "ref-for-authenticator\u2460\u2468\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator\u2460\u2468\u2465"}, {"id": "ref-for-authenticator\u2460\u2468\u2466"}, {"id": "ref-for-authenticator\u2460\u2468\u2467"}, {"id": "ref-for-authenticator\u2460\u2468\u2468"}, {"id": "ref-for-authenticator\u2461\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2461\u24ea\u2460"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2461"}, {"id": "ref-for-authenticator\u2461\u24ea\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2463"}, {"id": "ref-for-authenticator\u2461\u24ea\u2464"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2465"}], "title": "6.4.2. Language and Direction Encoding"}, {"refs": [{"id": "ref-for-authenticator\u2461\u24ea\u2466"}, {"id": "ref-for-authenticator\u2461\u24ea\u2467"}, {"id": "ref-for-authenticator\u2461\u24ea\u2468"}, {"id": "ref-for-authenticator\u2461\u2460\u24ea"}, {"id": "ref-for-authenticator\u2461\u2460\u2460"}, {"id": "ref-for-authenticator\u2461\u2460\u2461"}, {"id": "ref-for-authenticator\u2461\u2460\u2462"}, {"id": "ref-for-authenticator\u2461\u2460\u2463"}, {"id": "ref-for-authenticator\u2461\u2460\u2464"}, {"id": "ref-for-authenticator\u2461\u2460\u2465"}, {"id": "ref-for-authenticator\u2461\u2460\u2466"}, {"id": "ref-for-authenticator\u2461\u2460\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2460\u2468"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u24ea"}, {"id": "ref-for-authenticator\u2461\u2461\u2460"}, {"id": "ref-for-authenticator\u2461\u2461\u2461"}, {"id": "ref-for-authenticator\u2461\u2461\u2462"}, {"id": "ref-for-authenticator\u2461\u2461\u2463"}, {"id": "ref-for-authenticator\u2461\u2461\u2464"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2465"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2466"}, {"id": "ref-for-authenticator\u2461\u2461\u2467"}], "title": "6.5.6. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2461\u2468"}, {"id": "ref-for-authenticator\u2461\u2462\u24ea"}, {"id": "ref-for-authenticator\u2461\u2462\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2462"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2463"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2464"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2465"}, {"id": "ref-for-authenticator\u2461\u2462\u2466"}, {"id": "ref-for-authenticator\u2461\u2462\u2467"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2462\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u24ea"}, {"id": "ref-for-authenticator\u2461\u2463\u2460"}, {"id": "ref-for-authenticator\u2461\u2463\u2461"}, {"id": "ref-for-authenticator\u2461\u2463\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2463"}, {"id": "ref-for-authenticator\u2461\u2463\u2464"}, {"id": "ref-for-authenticator\u2461\u2463\u2465"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2463\u2466"}, {"id": "ref-for-authenticator\u2461\u2463\u2467"}, {"id": "ref-for-authenticator\u2461\u2463\u2468"}, {"id": "ref-for-authenticator\u2461\u2464\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2461"}, {"id": "ref-for-authenticator\u2461\u2464\u2462"}, {"id": "ref-for-authenticator\u2461\u2464\u2463"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2464\u2464"}, {"id": "ref-for-authenticator\u2461\u2464\u2465"}, {"id": "ref-for-authenticator\u2461\u2464\u2466"}, {"id": "ref-for-authenticator\u2461\u2464\u2467"}, {"id": "ref-for-authenticator\u2461\u2464\u2468"}, {"id": "ref-for-authenticator\u2461\u2465\u24ea"}, {"id": "ref-for-authenticator\u2461\u2465\u2460"}, {"id": "ref-for-authenticator\u2461\u2465\u2461"}, {"id": "ref-for-authenticator\u2461\u2465\u2462"}, {"id": "ref-for-authenticator\u2461\u2465\u2463"}, {"id": "ref-for-authenticator\u2461\u2465\u2464"}, {"id": "ref-for-authenticator\u2461\u2465\u2465"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2465\u2466"}, {"id": "ref-for-authenticator\u2461\u2465\u2467"}, {"id": "ref-for-authenticator\u2461\u2465\u2468"}, {"id": "ref-for-authenticator\u2461\u2466\u24ea"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2466\u2460"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2466\u2461"}, {"id": "ref-for-authenticator\u2461\u2466\u2462"}, {"id": "ref-for-authenticator\u2461\u2466\u2463"}, {"id": "ref-for-authenticator\u2461\u2466\u2464"}, {"id": "ref-for-authenticator\u2461\u2466\u2465"}, {"id": "ref-for-authenticator\u2461\u2466\u2466"}, {"id": "ref-for-authenticator\u2461\u2466\u2467"}, {"id": "ref-for-authenticator\u2461\u2466\u2468"}, {"id": "ref-for-authenticator\u2461\u2467\u24ea"}, {"id": "ref-for-authenticator\u2461\u2467\u2460"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2461"}], "title": "13.3. Security considerations for authenticators "}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2462"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2467\u2463"}, {"id": "ref-for-authenticator\u2461\u2467\u2464"}, {"id": "ref-for-authenticator\u2461\u2467\u2465"}, {"id": "ref-for-authenticator\u2461\u2467\u2466"}, {"id": "ref-for-authenticator\u2461\u2467\u2467"}, {"id": "ref-for-authenticator\u2461\u2467\u2468"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2468\u24ea"}, {"id": "ref-for-authenticator\u2461\u2468\u2460"}, {"id": "ref-for-authenticator\u2461\u2468\u2461"}, {"id": "ref-for-authenticator\u2461\u2468\u2462"}, {"id": "ref-for-authenticator\u2461\u2468\u2463"}, {"id": "ref-for-authenticator\u2461\u2468\u2464"}, {"id": "ref-for-authenticator\u2461\u2468\u2465"}, {"id": "ref-for-authenticator\u2461\u2468\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2468\u2467"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-authenticator\u2461\u2468\u2468"}, {"id": "ref-for-authenticator\u2462\u24ea\u24ea"}, {"id": "ref-for-authenticator\u2462\u24ea\u2460"}, {"id": "ref-for-authenticator\u2462\u24ea\u2461"}, {"id": "ref-for-authenticator\u2462\u24ea\u2462"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2463"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2464"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-authenticator\u2462\u24ea\u2465"}, {"id": "ref-for-authenticator\u2462\u24ea\u2466"}, {"id": "ref-for-authenticator\u2462\u24ea\u2467"}, {"id": "ref-for-authenticator\u2462\u24ea\u2468"}, {"id": "ref-for-authenticator\u2462\u2460\u24ea"}, {"id": "ref-for-authenticator\u2462\u2460\u2460"}, {"id": "ref-for-authenticator\u2462\u2460\u2461"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2460\u2462"}, {"id": "ref-for-authenticator\u2462\u2460\u2463"}, {"id": "ref-for-authenticator\u2462\u2460\u2464"}, {"id": "ref-for-authenticator\u2462\u2460\u2465"}, {"id": "ref-for-authenticator\u2462\u2460\u2466"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2460\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2460\u2468"}], "title": "14.4. Privacy considerations for authenticators"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2461\u24ea"}, {"id": "ref-for-authenticator\u2462\u2461\u2460"}, {"id": "ref-for-authenticator\u2462\u2461\u2461"}, {"id": "ref-for-authenticator\u2462\u2461\u2462"}, {"id": "ref-for-authenticator\u2462\u2461\u2463"}], "title": "14.4.1. Attestation Privacy"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2461\u2464"}, {"id": "ref-for-authenticator\u2462\u2461\u2465"}, {"id": "ref-for-authenticator\u2462\u2461\u2466"}, {"id": "ref-for-authenticator\u2462\u2461\u2467"}, {"id": "ref-for-authenticator\u2462\u2461\u2468"}, {"id": "ref-for-authenticator\u2462\u2462\u24ea"}, {"id": "ref-for-authenticator\u2462\u2462\u2460"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2462\u2461"}, {"id": "ref-for-authenticator\u2462\u2462\u2462"}, {"id": "ref-for-authenticator\u2462\u2462\u2463"}, {"id": "ref-for-authenticator\u2462\u2462\u2464"}, {"id": "ref-for-authenticator\u2462\u2462\u2465"}, {"id": "ref-for-authenticator\u2462\u2462\u2466"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2462\u2467"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2462\u2468"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2463\u24ea"}, {"id": "ref-for-authenticator\u2462\u2463\u2460"}, {"id": "ref-for-authenticator\u2462\u2463\u2461"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-authenticator\u2462\u2463\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
 window.dfnpanelData['webauthn-authenticator'] = {"dfnID": "webauthn-authenticator", "url": "#webauthn-authenticator", "dfnText": "WebAuthn Authenticator", "refSections": [{"refs": [{"id": "ref-for-webauthn-authenticator"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2460"}], "title": "2.2. Authenticators"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2461"}, {"id": "ref-for-webauthn-authenticator\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2463"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2465"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2467"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2468"}, {"id": "ref-for-webauthn-authenticator\u2460\u24ea"}], "title": "13.3.1. Attestation Certificate Hierarchy"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2460\u2460"}, {"id": "ref-for-webauthn-authenticator\u2460\u2461"}, {"id": "ref-for-webauthn-authenticator\u2460\u2462"}, {"id": "ref-for-webauthn-authenticator\u2460\u2463"}, {"id": "ref-for-webauthn-authenticator\u2460\u2464"}, {"id": "ref-for-webauthn-authenticator\u2460\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-webauthn-authenticator\u2460\u2466"}, {"id": "ref-for-webauthn-authenticator\u2460\u2467"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['authorization-gesture'] = {"dfnID": "authorization-gesture", "url": "#authorization-gesture", "dfnText": "Authorization Gesture", "refSections": [{"refs": [{"id": "ref-for-authorization-gesture"}], "title": "1.2.1. Registration"}, {"refs": [{"id": "ref-for-authorization-gesture\u2460"}], "title": "1.2.2. Authentication"}, {"refs": [{"id": "ref-for-authorization-gesture\u2461"}, {"id": "ref-for-authorization-gesture\u2462"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-authorization-gesture\u2463"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-authorization-gesture\u2464"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-authorization-gesture\u2465"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-authorization-gesture\u2466"}, {"id": "ref-for-authorization-gesture\u2467"}, {"id": "ref-for-authorization-gesture\u2468"}, {"id": "ref-for-authorization-gesture\u2460\u24ea"}, {"id": "ref-for-authorization-gesture\u2460\u2460"}, {"id": "ref-for-authorization-gesture\u2460\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authorization-gesture\u2460\u2462"}, {"id": "ref-for-authorization-gesture\u2460\u2463"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-authorization-gesture\u2460\u2464"}], "title": "5.1.6. Preventing Silent Access to an Existing Credential - PublicKeyCredential\u2019s [[preventSilentAccess]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authorization-gesture\u2460\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authorization-gesture\u2460\u2466"}, {"id": "ref-for-authorization-gesture\u2460\u2467"}, {"id": "ref-for-authorization-gesture\u2460\u2468"}, {"id": "ref-for-authorization-gesture\u2461\u24ea"}, {"id": "ref-for-authorization-gesture\u2461\u2460"}, {"id": "ref-for-authorization-gesture\u2461\u2461"}, {"id": "ref-for-authorization-gesture\u2461\u2462"}, {"id": "ref-for-authorization-gesture\u2461\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authorization-gesture\u2461\u2464"}, {"id": "ref-for-authorization-gesture\u2461\u2465"}, {"id": "ref-for-authorization-gesture\u2461\u2466"}, {"id": "ref-for-authorization-gesture\u2461\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authorization-gesture\u2461\u2468"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-authorization-gesture\u2462\u24ea"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['backed-up'] = {"dfnID": "backed-up", "url": "#backed-up", "dfnText": "Backed Up", "refSections": [{"refs": [{"id": "ref-for-backed-up"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-backed-up\u2460"}, {"id": "ref-for-backed-up\u2461"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backed-up\u2462"}, {"id": "ref-for-backed-up\u2463"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-backed-up\u2464"}], "title": "10.2.2.1. Relying Party Usage"}], "external": false};
+window.dfnpanelData['backed-up'] = {"dfnID": "backed-up", "url": "#backed-up", "dfnText": "Backed Up", "refSections": [{"refs": [{"id": "ref-for-backed-up"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-backed-up\u2460"}, {"id": "ref-for-backed-up\u2461"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backed-up\u2462"}, {"id": "ref-for-backed-up\u2463"}], "title": "6.1.3. Credential Backup State"}], "external": false};
 window.dfnpanelData['backup-eligibility'] = {"dfnID": "backup-eligibility", "url": "#backup-eligibility", "dfnText": "Backup Eligibility", "refSections": [{"refs": [{"id": "ref-for-backup-eligibility"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-backup-eligibility\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backup-eligibility\u2461"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-backup-eligibility\u2462"}], "title": "7.1. Registering a New Credential"}], "external": false};
-window.dfnpanelData['backup-eligible'] = {"dfnID": "backup-eligible", "url": "#backup-eligible", "dfnText": "Backup Eligible", "refSections": [{"refs": [{"id": "ref-for-backup-eligible"}, {"id": "ref-for-backup-eligible\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backup-eligible\u2461"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-backup-eligible\u2462"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['multi-device-credential'] = {"dfnID": "multi-device-credential", "url": "#multi-device-credential", "dfnText": "multi-device credential", "refSections": [{"refs": [{"id": "ref-for-multi-device-credential"}, {"id": "ref-for-multi-device-credential\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-multi-device-credential\u2461"}, {"id": "ref-for-multi-device-credential\u2462"}, {"id": "ref-for-multi-device-credential\u2463"}, {"id": "ref-for-multi-device-credential\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-multi-device-credential\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-multi-device-credential\u2466"}, {"id": "ref-for-multi-device-credential\u2467"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-multi-device-credential\u2468"}, {"id": "ref-for-multi-device-credential\u2460\u24ea"}, {"id": "ref-for-multi-device-credential\u2460\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-multi-device-credential\u2460\u2461"}], "title": "10.2.2.2.1. AAGUIDs"}], "external": false};
+window.dfnpanelData['backup-eligible'] = {"dfnID": "backup-eligible", "url": "#backup-eligible", "dfnText": "Backup Eligible", "refSections": [{"refs": [{"id": "ref-for-backup-eligible"}, {"id": "ref-for-backup-eligible\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backup-eligible\u2461"}, {"id": "ref-for-backup-eligible\u2462"}], "title": "10.2.2.1. Relying Party Usage"}], "external": false};
+window.dfnpanelData['multi-device-credential'] = {"dfnID": "multi-device-credential", "url": "#multi-device-credential", "dfnText": "multi-device credential", "refSections": [{"refs": [{"id": "ref-for-multi-device-credential"}, {"id": "ref-for-multi-device-credential\u2460"}, {"id": "ref-for-multi-device-credential\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-multi-device-credential\u2462"}, {"id": "ref-for-multi-device-credential\u2463"}, {"id": "ref-for-multi-device-credential\u2464"}, {"id": "ref-for-multi-device-credential\u2465"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-multi-device-credential\u2466"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-multi-device-credential\u2467"}, {"id": "ref-for-multi-device-credential\u2468"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-multi-device-credential\u2460\u24ea"}], "title": "10.2.2.2.1. AAGUIDs"}], "external": false};
 window.dfnpanelData['single-device-credential'] = {"dfnID": "single-device-credential", "url": "#single-device-credential", "dfnText": "single-device credential", "refSections": [{"refs": [{"id": "ref-for-single-device-credential"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-single-device-credential\u2460"}, {"id": "ref-for-single-device-credential\u2461"}, {"id": "ref-for-single-device-credential\u2462"}], "title": "6.1.3. Credential Backup State"}], "external": false};
 window.dfnpanelData['backup-state'] = {"dfnID": "backup-state", "url": "#backup-state", "dfnText": "Backup State", "refSections": [{"refs": [{"id": "ref-for-backup-state"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-backup-state\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-backup-state\u2461"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-backup-state\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-backup-state\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['biometric-authenticator'] = {"dfnID": "biometric-authenticator", "url": "#biometric-authenticator", "dfnText": "Biometric Authenticator", "refSections": [{"refs": [{"id": "ref-for-biometric-authenticator"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-biometric-authenticator\u2460"}, {"id": "ref-for-biometric-authenticator\u2461"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
@@ -11149,12 +11287,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['bound-credential'] = {"dfnID": "bound-credential", "url": "#bound-credential", "dfnText": "Bound credential", "refSections": [{"refs": [{"id": "ref-for-bound-credential\u2460"}, {"id": "ref-for-bound-credential\u2461"}, {"id": "ref-for-bound-credential\u2462"}, {"id": "ref-for-bound-credential\u2463"}, {"id": "ref-for-bound-credential\u2464"}, {"id": "ref-for-bound-credential\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-bound-credential\u2466"}, {"id": "ref-for-bound-credential\u2467"}, {"id": "ref-for-bound-credential\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-bound-credential\u2460\u24ea"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-bound-credential\u2460\u2460"}, {"id": "ref-for-bound-credential\u2460\u2461"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-bound-credential\u2460\u2462"}, {"id": "ref-for-bound-credential\u2460\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-bound-credential\u2460\u2464"}, {"id": "ref-for-bound-credential\u2460\u2465"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-bound-credential\u2460\u2466"}], "title": "14.5.1. Registration Ceremony Privacy"}], "external": false};
 window.dfnpanelData['contains'] = {"dfnID": "contains", "url": "#contains", "dfnText": "contains", "refSections": [{"refs": [{"id": "ref-for-contains"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-contains\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-contains\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": false};
 window.dfnpanelData['created-on'] = {"dfnID": "created-on", "url": "#created-on", "dfnText": "created on", "refSections": [{"refs": [{"id": "ref-for-created-on"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-created-on\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
-window.dfnpanelData['ceremony'] = {"dfnID": "ceremony", "url": "#ceremony", "dfnText": "Ceremony", "refSections": [{"refs": [{"id": "ref-for-ceremony"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-ceremony\u2460"}, {"id": "ref-for-ceremony\u2461"}, {"id": "ref-for-ceremony\u2462"}, {"id": "ref-for-ceremony\u2463"}, {"id": "ref-for-ceremony\u2464"}, {"id": "ref-for-ceremony\u2465"}, {"id": "ref-for-ceremony\u2466"}, {"id": "ref-for-ceremony\u2467"}, {"id": "ref-for-ceremony\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-ceremony\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2460"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2462"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2463"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2464"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2465"}, {"id": "ref-for-ceremony\u2460\u2466"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2467"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['client'] = {"dfnID": "client", "url": "#client", "dfnText": "Client", "refSections": [{"refs": [{"id": "ref-for-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-client\u2460"}, {"id": "ref-for-client\u2461"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client\u2462"}, {"id": "ref-for-client\u2463"}, {"id": "ref-for-client\u2464"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client\u2465"}, {"id": "ref-for-client\u2466"}, {"id": "ref-for-client\u2467"}, {"id": "ref-for-client\u2468"}, {"id": "ref-for-client\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460"}, {"id": "ref-for-client\u2460\u2461"}, {"id": "ref-for-client\u2460\u2462"}, {"id": "ref-for-client\u2460\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client\u2460\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client\u2460\u2465"}, {"id": "ref-for-client\u2460\u2466"}, {"id": "ref-for-client\u2460\u2467"}, {"id": "ref-for-client\u2460\u2468"}, {"id": "ref-for-client\u2461\u24ea"}, {"id": "ref-for-client\u2461\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2461"}, {"id": "ref-for-client\u2461\u2462"}, {"id": "ref-for-client\u2461\u2463"}, {"id": "ref-for-client\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client\u2461\u2466"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2467"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2468"}, {"id": "ref-for-client\u2462\u24ea"}, {"id": "ref-for-client\u2462\u2460"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client\u2462\u2461"}, {"id": "ref-for-client\u2462\u2462"}, {"id": "ref-for-client\u2462\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client\u2462\u2464"}, {"id": "ref-for-client\u2462\u2465"}, {"id": "ref-for-client\u2462\u2466"}, {"id": "ref-for-client\u2462\u2467"}, {"id": "ref-for-client\u2462\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client\u2463\u24ea"}, {"id": "ref-for-client\u2463\u2460"}, {"id": "ref-for-client\u2463\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2462"}, {"id": "ref-for-client\u2463\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2464"}, {"id": "ref-for-client\u2463\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client\u2463\u2466"}, {"id": "ref-for-client\u2463\u2467"}, {"id": "ref-for-client\u2463\u2468"}, {"id": "ref-for-client\u2464\u24ea"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client\u2464\u2460"}, {"id": "ref-for-client\u2464\u2461"}, {"id": "ref-for-client\u2464\u2462"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-client\u2464\u2463"}, {"id": "ref-for-client\u2464\u2464"}, {"id": "ref-for-client\u2464\u2465"}, {"id": "ref-for-client\u2464\u2466"}, {"id": "ref-for-client\u2464\u2467"}, {"id": "ref-for-client\u2464\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client\u2465\u24ea"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-client\u2465\u2460"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client\u2465\u2461"}, {"id": "ref-for-client\u2465\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client\u2465\u2463"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client\u2465\u2464"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-client\u2465\u2465"}, {"id": "ref-for-client\u2465\u2466"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client\u2465\u2467"}, {"id": "ref-for-client\u2465\u2468"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client\u2466\u24ea"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client\u2466\u2460"}, {"id": "ref-for-client\u2466\u2461"}, {"id": "ref-for-client\u2466\u2462"}, {"id": "ref-for-client\u2466\u2463"}, {"id": "ref-for-client\u2466\u2464"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2466"}, {"id": "ref-for-client\u2466\u2467"}, {"id": "ref-for-client\u2466\u2468"}, {"id": "ref-for-client\u2467\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client\u2467\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client\u2467\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client\u2467\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client\u2467\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-client\u2467\u2464"}, {"id": "ref-for-client\u2467\u2465"}, {"id": "ref-for-client\u2467\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client\u2467\u2467"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client\u2467\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client\u2468\u24ea"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-client\u2468\u2460"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-client\u2468\u2461"}, {"id": "ref-for-client\u2468\u2462"}, {"id": "ref-for-client\u2468\u2463"}, {"id": "ref-for-client\u2468\u2464"}, {"id": "ref-for-client\u2468\u2465"}, {"id": "ref-for-client\u2468\u2466"}, {"id": "ref-for-client\u2468\u2467"}, {"id": "ref-for-client\u2468\u2468"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u24ea"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2460"}, {"id": "ref-for-client\u2460\u24ea\u2461"}, {"id": "ref-for-client\u2460\u24ea\u2462"}, {"id": "ref-for-client\u2460\u24ea\u2463"}, {"id": "ref-for-client\u2460\u24ea\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2465"}, {"id": "ref-for-client\u2460\u24ea\u2466"}, {"id": "ref-for-client\u2460\u24ea\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2468"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460\u2460"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2461"}], "title": "14.5. Privacy considerations for clients"}], "external": false};
+window.dfnpanelData['ceremony'] = {"dfnID": "ceremony", "url": "#ceremony", "dfnText": "Ceremony", "refSections": [{"refs": [{"id": "ref-for-ceremony"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-ceremony\u2460"}, {"id": "ref-for-ceremony\u2461"}, {"id": "ref-for-ceremony\u2462"}, {"id": "ref-for-ceremony\u2463"}, {"id": "ref-for-ceremony\u2464"}, {"id": "ref-for-ceremony\u2465"}, {"id": "ref-for-ceremony\u2466"}, {"id": "ref-for-ceremony\u2467"}, {"id": "ref-for-ceremony\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-ceremony\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2460"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2462"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2463"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2464"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2465"}, {"id": "ref-for-ceremony\u2460\u2466"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2467"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
+window.dfnpanelData['client'] = {"dfnID": "client", "url": "#client", "dfnText": "Client", "refSections": [{"refs": [{"id": "ref-for-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-client\u2460"}, {"id": "ref-for-client\u2461"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client\u2462"}, {"id": "ref-for-client\u2463"}, {"id": "ref-for-client\u2464"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client\u2465"}, {"id": "ref-for-client\u2466"}, {"id": "ref-for-client\u2467"}, {"id": "ref-for-client\u2468"}, {"id": "ref-for-client\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460"}, {"id": "ref-for-client\u2460\u2461"}, {"id": "ref-for-client\u2460\u2462"}, {"id": "ref-for-client\u2460\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client\u2460\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client\u2460\u2465"}, {"id": "ref-for-client\u2460\u2466"}, {"id": "ref-for-client\u2460\u2467"}, {"id": "ref-for-client\u2460\u2468"}, {"id": "ref-for-client\u2461\u24ea"}, {"id": "ref-for-client\u2461\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2461"}, {"id": "ref-for-client\u2461\u2462"}, {"id": "ref-for-client\u2461\u2463"}, {"id": "ref-for-client\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client\u2461\u2466"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2467"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2468"}, {"id": "ref-for-client\u2462\u24ea"}, {"id": "ref-for-client\u2462\u2460"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client\u2462\u2461"}, {"id": "ref-for-client\u2462\u2462"}, {"id": "ref-for-client\u2462\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client\u2462\u2464"}, {"id": "ref-for-client\u2462\u2465"}, {"id": "ref-for-client\u2462\u2466"}, {"id": "ref-for-client\u2462\u2467"}, {"id": "ref-for-client\u2462\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client\u2463\u24ea"}, {"id": "ref-for-client\u2463\u2460"}, {"id": "ref-for-client\u2463\u2461"}, {"id": "ref-for-client\u2463\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2463"}, {"id": "ref-for-client\u2463\u2464"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2465"}, {"id": "ref-for-client\u2463\u2466"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client\u2463\u2467"}, {"id": "ref-for-client\u2463\u2468"}, {"id": "ref-for-client\u2464\u24ea"}, {"id": "ref-for-client\u2464\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client\u2464\u2461"}, {"id": "ref-for-client\u2464\u2462"}, {"id": "ref-for-client\u2464\u2463"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-client\u2464\u2464"}, {"id": "ref-for-client\u2464\u2465"}, {"id": "ref-for-client\u2464\u2466"}, {"id": "ref-for-client\u2464\u2467"}, {"id": "ref-for-client\u2464\u2468"}, {"id": "ref-for-client\u2465\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client\u2465\u2460"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-client\u2465\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client\u2465\u2462"}, {"id": "ref-for-client\u2465\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client\u2465\u2464"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client\u2465\u2465"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-client\u2465\u2466"}, {"id": "ref-for-client\u2465\u2467"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client\u2465\u2468"}, {"id": "ref-for-client\u2466\u24ea"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client\u2466\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client\u2466\u2461"}, {"id": "ref-for-client\u2466\u2462"}, {"id": "ref-for-client\u2466\u2463"}, {"id": "ref-for-client\u2466\u2464"}, {"id": "ref-for-client\u2466\u2465"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2467"}, {"id": "ref-for-client\u2466\u2468"}, {"id": "ref-for-client\u2467\u24ea"}, {"id": "ref-for-client\u2467\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client\u2467\u2461"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client\u2467\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client\u2467\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client\u2467\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-client\u2467\u2465"}, {"id": "ref-for-client\u2467\u2466"}, {"id": "ref-for-client\u2467\u2467"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client\u2467\u2468"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client\u2468\u24ea"}, {"id": "ref-for-client\u2468\u2460"}, {"id": "ref-for-client\u2468\u2461"}, {"id": "ref-for-client\u2468\u2462"}, {"id": "ref-for-client\u2468\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client\u2468\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-client\u2468\u2465"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-client\u2468\u2466"}, {"id": "ref-for-client\u2468\u2467"}, {"id": "ref-for-client\u2468\u2468"}, {"id": "ref-for-client\u2460\u24ea\u24ea"}, {"id": "ref-for-client\u2460\u24ea\u2460"}, {"id": "ref-for-client\u2460\u24ea\u2461"}, {"id": "ref-for-client\u2460\u24ea\u2462"}, {"id": "ref-for-client\u2460\u24ea\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2464"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2465"}, {"id": "ref-for-client\u2460\u24ea\u2466"}, {"id": "ref-for-client\u2460\u24ea\u2467"}, {"id": "ref-for-client\u2460\u24ea\u2468"}, {"id": "ref-for-client\u2460\u2460\u24ea"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2460"}, {"id": "ref-for-client\u2460\u2460\u2461"}, {"id": "ref-for-client\u2460\u2460\u2462"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2463"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2464"}, {"id": "ref-for-client\u2460\u2460\u2465"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2466"}], "title": "14.5. Privacy considerations for clients"}], "external": false};
 window.dfnpanelData['webauthn-client'] = {"dfnID": "webauthn-client", "url": "#webauthn-client", "dfnText": "WebAuthn Client", "refSections": [{"refs": [{"id": "ref-for-webauthn-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-client\u2460"}, {"id": "ref-for-webauthn-client\u2461"}, {"id": "ref-for-webauthn-client\u2462"}, {"id": "ref-for-webauthn-client\u2463"}, {"id": "ref-for-webauthn-client\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-client\u2465"}], "title": "6.3. Authenticator Operations"}, {"refs": [{"id": "ref-for-webauthn-client\u2466"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-client\u2467"}], "title": "13.4.8. Code injection attacks"}], "external": false};
 window.dfnpanelData['client-device'] = {"dfnID": "client-device", "url": "#client-device", "dfnText": "Client Device", "refSections": [{"refs": [{"id": "ref-for-client-device"}, {"id": "ref-for-client-device\u2460"}, {"id": "ref-for-client-device\u2461"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-client-device\u2462"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-device\u2463"}, {"id": "ref-for-client-device\u2464"}, {"id": "ref-for-client-device\u2465"}, {"id": "ref-for-client-device\u2466"}, {"id": "ref-for-client-device\u2467"}, {"id": "ref-for-client-device\u2468"}, {"id": "ref-for-client-device\u2460\u24ea"}, {"id": "ref-for-client-device\u2460\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-device\u2460\u2461"}, {"id": "ref-for-client-device\u2460\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-device\u2460\u2463"}, {"id": "ref-for-client-device\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-device\u2460\u2465"}, {"id": "ref-for-client-device\u2460\u2466"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client-device\u2460\u2467"}, {"id": "ref-for-client-device\u2460\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client-device\u2461\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-client-device\u2461\u2460"}, {"id": "ref-for-client-device\u2461\u2461"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-device\u2461\u2462"}, {"id": "ref-for-client-device\u2461\u2463"}, {"id": "ref-for-client-device\u2461\u2464"}, {"id": "ref-for-client-device\u2461\u2465"}, {"id": "ref-for-client-device\u2461\u2466"}, {"id": "ref-for-client-device\u2461\u2467"}, {"id": "ref-for-client-device\u2461\u2468"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client-device\u2462\u24ea"}, {"id": "ref-for-client-device\u2462\u2460"}, {"id": "ref-for-client-device\u2462\u2461"}, {"id": "ref-for-client-device\u2462\u2462"}, {"id": "ref-for-client-device\u2462\u2463"}, {"id": "ref-for-client-device\u2462\u2464"}, {"id": "ref-for-client-device\u2462\u2465"}, {"id": "ref-for-client-device\u2462\u2466"}, {"id": "ref-for-client-device\u2462\u2467"}, {"id": "ref-for-client-device\u2462\u2468"}, {"id": "ref-for-client-device\u2463\u24ea"}, {"id": "ref-for-client-device\u2463\u2460"}, {"id": "ref-for-client-device\u2463\u2461"}, {"id": "ref-for-client-device\u2463\u2462"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client-device\u2463\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client-device\u2463\u2464"}, {"id": "ref-for-client-device\u2463\u2465"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-client-device\u2463\u2466"}, {"id": "ref-for-client-device\u2463\u2467"}], "title": "14.5.3. Privacy Between Operating System Accounts"}], "external": false};
 window.dfnpanelData['webauthn-client-device'] = {"dfnID": "webauthn-client-device", "url": "#webauthn-client-device", "dfnText": "WebAuthn Client Device", "refSections": [{"refs": [{"id": "ref-for-webauthn-client-device"}, {"id": "ref-for-webauthn-client-device\u2460"}], "title": "4. Terminology"}], "external": false};
-window.dfnpanelData['client-platform'] = {"dfnID": "client-platform", "url": "#client-platform", "dfnText": "Client Platform", "refSections": [{"refs": [{"id": "ref-for-client-platform"}, {"id": "ref-for-client-platform\u2460"}, {"id": "ref-for-client-platform\u2461"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-platform\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client-platform\u2463"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client-platform\u2464"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-client-platform\u2465"}, {"id": "ref-for-client-platform\u2466"}, {"id": "ref-for-client-platform\u2467"}, {"id": "ref-for-client-platform\u2468"}, {"id": "ref-for-client-platform\u2460\u24ea"}, {"id": "ref-for-client-platform\u2460\u2460"}, {"id": "ref-for-client-platform\u2460\u2461"}, {"id": "ref-for-client-platform\u2460\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2463"}, {"id": "ref-for-client-platform\u2460\u2464"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2465"}, {"id": "ref-for-client-platform\u2460\u2466"}, {"id": "ref-for-client-platform\u2460\u2467"}, {"id": "ref-for-client-platform\u2460\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u24ea"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2460"}, {"id": "ref-for-client-platform\u2461\u2461"}, {"id": "ref-for-client-platform\u2461\u2462"}, {"id": "ref-for-client-platform\u2461\u2463"}, {"id": "ref-for-client-platform\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2465"}, {"id": "ref-for-client-platform\u2461\u2466"}, {"id": "ref-for-client-platform\u2461\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2468"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u24ea"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2460"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2464"}, {"id": "ref-for-client-platform\u2462\u2465"}, {"id": "ref-for-client-platform\u2462\u2466"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2467"}, {"id": "ref-for-client-platform\u2462\u2468"}, {"id": "ref-for-client-platform\u2463\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2460"}, {"id": "ref-for-client-platform\u2463\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2462"}, {"id": "ref-for-client-platform\u2463\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2464"}, {"id": "ref-for-client-platform\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2467"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2468"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-platform\u2464\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2461"}, {"id": "ref-for-client-platform\u2464\u2462"}, {"id": "ref-for-client-platform\u2464\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2465"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2466"}, {"id": "ref-for-client-platform\u2464\u2467"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['client-platform'] = {"dfnID": "client-platform", "url": "#client-platform", "dfnText": "Client Platform", "refSections": [{"refs": [{"id": "ref-for-client-platform"}, {"id": "ref-for-client-platform\u2460"}, {"id": "ref-for-client-platform\u2461"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-platform\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client-platform\u2463"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client-platform\u2464"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-client-platform\u2465"}, {"id": "ref-for-client-platform\u2466"}, {"id": "ref-for-client-platform\u2467"}, {"id": "ref-for-client-platform\u2468"}, {"id": "ref-for-client-platform\u2460\u24ea"}, {"id": "ref-for-client-platform\u2460\u2460"}, {"id": "ref-for-client-platform\u2460\u2461"}, {"id": "ref-for-client-platform\u2460\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2463"}, {"id": "ref-for-client-platform\u2460\u2464"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2465"}, {"id": "ref-for-client-platform\u2460\u2466"}, {"id": "ref-for-client-platform\u2460\u2467"}, {"id": "ref-for-client-platform\u2460\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u24ea"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2460"}, {"id": "ref-for-client-platform\u2461\u2461"}, {"id": "ref-for-client-platform\u2461\u2462"}, {"id": "ref-for-client-platform\u2461\u2463"}, {"id": "ref-for-client-platform\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2465"}, {"id": "ref-for-client-platform\u2461\u2466"}, {"id": "ref-for-client-platform\u2461\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2468"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u24ea"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2460"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2464"}, {"id": "ref-for-client-platform\u2462\u2465"}, {"id": "ref-for-client-platform\u2462\u2466"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2467"}, {"id": "ref-for-client-platform\u2462\u2468"}, {"id": "ref-for-client-platform\u2463\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2460"}, {"id": "ref-for-client-platform\u2463\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2462"}, {"id": "ref-for-client-platform\u2463\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2464"}, {"id": "ref-for-client-platform\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2467"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2468"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-platform\u2464\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2461"}, {"id": "ref-for-client-platform\u2464\u2462"}, {"id": "ref-for-client-platform\u2464\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2465"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2466"}, {"id": "ref-for-client-platform\u2464\u2467"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
 window.dfnpanelData['client-side'] = {"dfnID": "client-side", "url": "#client-side", "dfnText": "Client-Side", "refSections": [{"refs": [{"id": "ref-for-client-side"}, {"id": "ref-for-client-side\u2460"}, {"id": "ref-for-client-side\u2461"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['client-side-discoverable-public-key-credential-source'] = {"dfnID": "client-side-discoverable-public-key-credential-source", "url": "#client-side-discoverable-public-key-credential-source", "dfnText": "Client-side discoverable Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2460"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2462"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2464"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2466"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
 window.dfnpanelData['client-side-discoverable-credential'] = {"dfnID": "client-side-discoverable-credential", "url": "#client-side-discoverable-credential", "dfnText": "Client-side discoverable Credential", "refSections": [{"refs": [{"id": "ref-for-client-side-discoverable-credential"}, {"id": "ref-for-client-side-discoverable-credential\u2460"}, {"id": "ref-for-client-side-discoverable-credential\u2461"}, {"id": "ref-for-client-side-discoverable-credential\u2462"}, {"id": "ref-for-client-side-discoverable-credential\u2463"}, {"id": "ref-for-client-side-discoverable-credential\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2465"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2466"}, {"id": "ref-for-client-side-discoverable-credential\u2467"}, {"id": "ref-for-client-side-discoverable-credential\u2468"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u24ea"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2460"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2461"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2462"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2465"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2466"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2467"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
@@ -11163,14 +11301,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['resident-credential'] = {"dfnID": "resident-credential", "url": "#resident-credential", "dfnText": "Resident Credential", "refSections": [{"refs": [{"id": "ref-for-resident-credential"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-resident-credential\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
 window.dfnpanelData['resident-key'] = {"dfnID": "resident-key", "url": "#resident-key", "dfnText": "Resident Key", "refSections": [{"refs": [{"id": "ref-for-resident-key"}, {"id": "ref-for-resident-key\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-resident-key\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
 window.dfnpanelData['conforming-user-agent'] = {"dfnID": "conforming-user-agent", "url": "#conforming-user-agent", "dfnText": "Conforming User Agent", "refSections": [{"refs": [{"id": "ref-for-conforming-user-agent"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2460"}], "title": "2.1. User Agents"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2461"}], "title": "2.2. Authenticators"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2463"}], "title": "6.4.1. String Truncation"}], "external": false};
-window.dfnpanelData['credential-id'] = {"dfnID": "credential-id", "url": "#credential-id", "dfnText": "Credential ID", "refSections": [{"refs": [{"id": "ref-for-credential-id"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-credential-id\u2460"}, {"id": "ref-for-credential-id\u2461"}, {"id": "ref-for-credential-id\u2462"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-credential-id\u2463"}, {"id": "ref-for-credential-id\u2464"}, {"id": "ref-for-credential-id\u2465"}, {"id": "ref-for-credential-id\u2466"}, {"id": "ref-for-credential-id\u2467"}, {"id": "ref-for-credential-id\u2468"}, {"id": "ref-for-credential-id\u2460\u24ea"}, {"id": "ref-for-credential-id\u2460\u2460"}, {"id": "ref-for-credential-id\u2460\u2461"}, {"id": "ref-for-credential-id\u2460\u2462"}, {"id": "ref-for-credential-id\u2460\u2463"}, {"id": "ref-for-credential-id\u2460\u2464"}, {"id": "ref-for-credential-id\u2460\u2465"}, {"id": "ref-for-credential-id\u2460\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-id\u2460\u2467"}, {"id": "ref-for-credential-id\u2460\u2468"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-id\u2461\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2463"}, {"id": "ref-for-credential-id\u2461\u2464"}, {"id": "ref-for-credential-id\u2461\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2466"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u24ea"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2460"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2461"}, {"id": "ref-for-credential-id\u2462\u2462"}, {"id": "ref-for-credential-id\u2462\u2463"}, {"id": "ref-for-credential-id\u2462\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2465"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2468"}, {"id": "ref-for-credential-id\u2463\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2460"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2461"}, {"id": "ref-for-credential-id\u2463\u2462"}, {"id": "ref-for-credential-id\u2463\u2463"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2465"}, {"id": "ref-for-credential-id\u2463\u2466"}, {"id": "ref-for-credential-id\u2463\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2468"}, {"id": "ref-for-credential-id\u2464\u24ea"}, {"id": "ref-for-credential-id\u2464\u2460"}, {"id": "ref-for-credential-id\u2464\u2461"}, {"id": "ref-for-credential-id\u2464\u2462"}, {"id": "ref-for-credential-id\u2464\u2463"}, {"id": "ref-for-credential-id\u2464\u2464"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
+window.dfnpanelData['credential-id'] = {"dfnID": "credential-id", "url": "#credential-id", "dfnText": "Credential ID", "refSections": [{"refs": [{"id": "ref-for-credential-id"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-credential-id\u2460"}, {"id": "ref-for-credential-id\u2461"}, {"id": "ref-for-credential-id\u2462"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-credential-id\u2463"}, {"id": "ref-for-credential-id\u2464"}, {"id": "ref-for-credential-id\u2465"}, {"id": "ref-for-credential-id\u2466"}, {"id": "ref-for-credential-id\u2467"}, {"id": "ref-for-credential-id\u2468"}, {"id": "ref-for-credential-id\u2460\u24ea"}, {"id": "ref-for-credential-id\u2460\u2460"}, {"id": "ref-for-credential-id\u2460\u2461"}, {"id": "ref-for-credential-id\u2460\u2462"}, {"id": "ref-for-credential-id\u2460\u2463"}, {"id": "ref-for-credential-id\u2460\u2464"}, {"id": "ref-for-credential-id\u2460\u2465"}, {"id": "ref-for-credential-id\u2460\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-id\u2460\u2467"}, {"id": "ref-for-credential-id\u2460\u2468"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-id\u2461\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2463"}, {"id": "ref-for-credential-id\u2461\u2464"}, {"id": "ref-for-credential-id\u2461\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2466"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-credential-id\u2461\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u24ea"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2460"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2461"}, {"id": "ref-for-credential-id\u2462\u2462"}, {"id": "ref-for-credential-id\u2462\u2463"}, {"id": "ref-for-credential-id\u2462\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2465"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-credential-id\u2462\u2468"}, {"id": "ref-for-credential-id\u2463\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2461"}, {"id": "ref-for-credential-id\u2463\u2462"}, {"id": "ref-for-credential-id\u2463\u2463"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2465"}, {"id": "ref-for-credential-id\u2463\u2466"}, {"id": "ref-for-credential-id\u2463\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-credential-id\u2463\u2468"}, {"id": "ref-for-credential-id\u2464\u24ea"}, {"id": "ref-for-credential-id\u2464\u2460"}, {"id": "ref-for-credential-id\u2464\u2461"}, {"id": "ref-for-credential-id\u2464\u2462"}, {"id": "ref-for-credential-id\u2464\u2463"}, {"id": "ref-for-credential-id\u2464\u2464"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
 window.dfnpanelData['credential-key-pair'] = {"dfnID": "credential-key-pair", "url": "#credential-key-pair", "dfnText": "Credential Key Pair", "refSections": [{"refs": [{"id": "ref-for-credential-key-pair"}, {"id": "ref-for-credential-key-pair\u2460"}, {"id": "ref-for-credential-key-pair\u2461"}, {"id": "ref-for-credential-key-pair\u2462"}, {"id": "ref-for-credential-key-pair\u2463"}, {"id": "ref-for-credential-key-pair\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-key-pair\u2465"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-credential-key-pair\u2466"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
 window.dfnpanelData['credential-private-key'] = {"dfnID": "credential-private-key", "url": "#credential-private-key", "dfnText": "Credential Private Key", "refSections": [{"refs": [{"id": "ref-for-credential-private-key"}, {"id": "ref-for-credential-private-key\u2460"}, {"id": "ref-for-credential-private-key\u2461"}, {"id": "ref-for-credential-private-key\u2462"}, {"id": "ref-for-credential-private-key\u2463"}, {"id": "ref-for-credential-private-key\u2464"}, {"id": "ref-for-credential-private-key\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-private-key\u2466"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-credential-private-key\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-credential-private-key\u2468"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u24ea"}, {"id": "ref-for-credential-private-key\u2460\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2461"}, {"id": "ref-for-credential-private-key\u2460\u2462"}, {"id": "ref-for-credential-private-key\u2460\u2463"}, {"id": "ref-for-credential-private-key\u2460\u2464"}, {"id": "ref-for-credential-private-key\u2460\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2466"}, {"id": "ref-for-credential-private-key\u2460\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-credential-private-key\u2460\u2468"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2461"}, {"id": "ref-for-credential-private-key\u2461\u2462"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2463"}, {"id": "ref-for-credential-private-key\u2461\u2464"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-credential-private-key\u2461\u2465"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
 window.dfnpanelData['credential-public-key'] = {"dfnID": "credential-public-key", "url": "#credential-public-key", "dfnText": "Credential Public Key", "refSections": [{"refs": [{"id": "ref-for-credential-public-key"}, {"id": "ref-for-credential-public-key\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-credential-public-key\u2461"}, {"id": "ref-for-credential-public-key\u2462"}, {"id": "ref-for-credential-public-key\u2463"}, {"id": "ref-for-credential-public-key\u2464"}, {"id": "ref-for-credential-public-key\u2465"}, {"id": "ref-for-credential-public-key\u2466"}, {"id": "ref-for-credential-public-key\u2467"}, {"id": "ref-for-credential-public-key\u2468"}, {"id": "ref-for-credential-public-key\u2460\u24ea"}, {"id": "ref-for-credential-public-key\u2460\u2460"}, {"id": "ref-for-credential-public-key\u2460\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-public-key\u2460\u2462"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-credential-public-key\u2460\u2463"}, {"id": "ref-for-credential-public-key\u2460\u2464"}, {"id": "ref-for-credential-public-key\u2460\u2465"}, {"id": "ref-for-credential-public-key\u2460\u2466"}, {"id": "ref-for-credential-public-key\u2460\u2467"}, {"id": "ref-for-credential-public-key\u2460\u2468"}, {"id": "ref-for-credential-public-key\u2461\u24ea"}, {"id": "ref-for-credential-public-key\u2461\u2460"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2461"}], "title": "5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2462"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2463"}, {"id": "ref-for-credential-public-key\u2461\u2464"}, {"id": "ref-for-credential-public-key\u2461\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-credential-public-key\u2461\u2466"}, {"id": "ref-for-credential-public-key\u2461\u2467"}, {"id": "ref-for-credential-public-key\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u24ea"}, {"id": "ref-for-credential-public-key\u2462\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2461"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2462"}, {"id": "ref-for-credential-public-key\u2462\u2463"}], "title": "8.8. Apple Anonymous Attestation Statement Format"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2464"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2465"}, {"id": "ref-for-credential-public-key\u2462\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-credential-public-key\u2462\u2468"}, {"id": "ref-for-credential-public-key\u2463\u24ea"}, {"id": "ref-for-credential-public-key\u2463\u2460"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
 window.dfnpanelData['user-public-key'] = {"dfnID": "user-public-key", "url": "#user-public-key", "dfnText": "User Public Key", "refSections": [{"refs": [{"id": "ref-for-user-public-key"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-public-key\u2460"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
-window.dfnpanelData['user-credential'] = {"dfnID": "user-credential", "url": "#user-credential", "dfnText": "User Credential", "refSections": [{"refs": [{"id": "ref-for-user-credential"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-credential\u2460"}, {"id": "ref-for-user-credential\u2461"}, {"id": "ref-for-user-credential\u2462"}, {"id": "ref-for-user-credential\u2463"}, {"id": "ref-for-user-credential\u2464"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-user-credential\u2465"}, {"id": "ref-for-user-credential\u2466"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-user-credential\u2467"}, {"id": "ref-for-user-credential\u2468"}, {"id": "ref-for-user-credential\u2460\u24ea"}, {"id": "ref-for-user-credential\u2460\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2461"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2462"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['credential-properties'] = {"dfnID": "credential-properties", "url": "#credential-properties", "dfnText": "Credential Properties", "refSections": [{"refs": [{"id": "ref-for-credential-properties"}, {"id": "ref-for-credential-properties\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-properties\u2461"}, {"id": "ref-for-credential-properties\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
-window.dfnpanelData['credential-record'] = {"dfnID": "credential-record", "url": "#credential-record", "dfnText": "Credential Record", "refSections": [{"refs": [{"id": "ref-for-credential-record"}, {"id": "ref-for-credential-record\u2460"}, {"id": "ref-for-credential-record\u2461"}, {"id": "ref-for-credential-record\u2462"}, {"id": "ref-for-credential-record\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-record\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-credential-record\u2465"}, {"id": "ref-for-credential-record\u2466"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-record\u2467"}, {"id": "ref-for-credential-record\u2468"}, {"id": "ref-for-credential-record\u2460\u24ea"}, {"id": "ref-for-credential-record\u2460\u2460"}, {"id": "ref-for-credential-record\u2460\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-credential-record\u2460\u2462"}, {"id": "ref-for-credential-record\u2460\u2463"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-credential-record\u2460\u2464"}], "title": "10.2.2.3.1. Registration (create())"}], "external": false};
+window.dfnpanelData['user-credential'] = {"dfnID": "user-credential", "url": "#user-credential", "dfnText": "User Credential", "refSections": [{"refs": [{"id": "ref-for-user-credential"}, {"id": "ref-for-user-credential\u2460"}, {"id": "ref-for-user-credential\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-credential\u2462"}, {"id": "ref-for-user-credential\u2463"}, {"id": "ref-for-user-credential\u2464"}, {"id": "ref-for-user-credential\u2465"}, {"id": "ref-for-user-credential\u2466"}, {"id": "ref-for-user-credential\u2467"}, {"id": "ref-for-user-credential\u2468"}, {"id": "ref-for-user-credential\u2460\u24ea"}, {"id": "ref-for-user-credential\u2460\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2461"}, {"id": "ref-for-user-credential\u2460\u2462"}, {"id": "ref-for-user-credential\u2460\u2463"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2464"}, {"id": "ref-for-user-credential\u2460\u2465"}, {"id": "ref-for-user-credential\u2460\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2467"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-user-credential\u2460\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-user-credential\u2461\u24ea"}, {"id": "ref-for-user-credential\u2461\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['credential-properties'] = {"dfnID": "credential-properties", "url": "#credential-properties", "dfnText": "Credential Properties", "refSections": [{"refs": [{"id": "ref-for-credential-properties"}, {"id": "ref-for-credential-properties\u2460"}, {"id": "ref-for-credential-properties\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-properties\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
+window.dfnpanelData['credential-record'] = {"dfnID": "credential-record", "url": "#credential-record", "dfnText": "Credential Record", "refSections": [{"refs": [{"id": "ref-for-credential-record"}, {"id": "ref-for-credential-record\u2460"}, {"id": "ref-for-credential-record\u2461"}, {"id": "ref-for-credential-record\u2462"}, {"id": "ref-for-credential-record\u2463"}, {"id": "ref-for-credential-record\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credential-record\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-credential-record\u2466"}, {"id": "ref-for-credential-record\u2467"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-credential-record\u2468"}, {"id": "ref-for-credential-record\u2460\u24ea"}, {"id": "ref-for-credential-record\u2460\u2460"}, {"id": "ref-for-credential-record\u2460\u2461"}, {"id": "ref-for-credential-record\u2460\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-credential-record\u2460\u2463"}, {"id": "ref-for-credential-record\u2460\u2464"}, {"id": "ref-for-credential-record\u2460\u2465"}, {"id": "ref-for-credential-record\u2460\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-credential-record\u2460\u2467"}, {"id": "ref-for-credential-record\u2460\u2468"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-credential-record\u2461\u24ea"}], "title": "10.2.2.3.1. Registration (create())"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-type'] = {"dfnID": "abstract-opdef-credential-record-type", "url": "#abstract-opdef-credential-record-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-type\u2460"}], "title": "7.1. Registering a New Credential"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-id'] = {"dfnID": "abstract-opdef-credential-record-id", "url": "#abstract-opdef-credential-record-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-id\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-id\u2461"}, {"id": "ref-for-abstract-opdef-credential-record-id\u2462"}, {"id": "ref-for-abstract-opdef-credential-record-id\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-publickey'] = {"dfnID": "abstract-opdef-credential-record-publickey", "url": "#abstract-opdef-credential-record-publickey", "dfnText": "publicKey", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-publickey"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-publickey\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-publickey\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
@@ -11179,18 +11317,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['abstract-opdef-credential-record-uvinitialized'] = {"dfnID": "abstract-opdef-credential-record-uvinitialized", "url": "#abstract-opdef-credential-record-uvinitialized", "dfnText": "uvInitialized", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-uvinitialized"}, {"id": "ref-for-abstract-opdef-credential-record-uvinitialized\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-uvinitialized\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-uvinitialized\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-backupeligible'] = {"dfnID": "abstract-opdef-credential-record-backupeligible", "url": "#abstract-opdef-credential-record-backupeligible", "dfnText": "backupEligible", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-backupeligible"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-backupeligible\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-backupeligible\u2461"}, {"id": "ref-for-abstract-opdef-credential-record-backupeligible\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-backupstate'] = {"dfnID": "abstract-opdef-credential-record-backupstate", "url": "#abstract-opdef-credential-record-backupstate", "dfnText": "backupState", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-backupstate"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-backupstate\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-backupstate\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
-window.dfnpanelData['abstract-opdef-credential-record-attestationobject'] = {"dfnID": "abstract-opdef-credential-record-attestationobject", "url": "#abstract-opdef-credential-record-attestationobject", "dfnText": "attestationObject", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2462"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": false};
+window.dfnpanelData['abstract-opdef-credential-record-attestationobject'] = {"dfnID": "abstract-opdef-credential-record-attestationobject", "url": "#abstract-opdef-credential-record-attestationobject", "dfnText": "attestationObject", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationobject\u2462"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": false};
 window.dfnpanelData['abstract-opdef-credential-record-attestationclientdatajson'] = {"dfnID": "abstract-opdef-credential-record-attestationclientdatajson", "url": "#abstract-opdef-credential-record-attestationclientdatajson", "dfnText": "attestationClientDataJSON", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationclientdatajson"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-attestationclientdatajson\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
+window.dfnpanelData['abstract-opdef-credential-record-authenticatordisplayname'] = {"dfnID": "abstract-opdef-credential-record-authenticatordisplayname", "url": "#abstract-opdef-credential-record-authenticatordisplayname", "dfnText": "authenticatorDisplayName", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-authenticatordisplayname"}, {"id": "ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2461"}, {"id": "ref-for-abstract-opdef-credential-record-authenticatordisplayname\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['credential-descriptor-for-a-credential-record'] = {"dfnID": "credential-descriptor-for-a-credential-record", "url": "#credential-descriptor-for-a-credential-record", "dfnText": "credential descriptor for a credential record", "refSections": [{"refs": [{"id": "ref-for-credential-descriptor-for-a-credential-record"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": false};
-window.dfnpanelData['hardware-bound-device-key-pair'] = {"dfnID": "hardware-bound-device-key-pair", "url": "#hardware-bound-device-key-pair", "dfnText": "Hardware-bound Device Key Pair", "refSections": [{"refs": [{"id": "ref-for-hardware-bound-device-key-pair"}, {"id": "ref-for-hardware-bound-device-key-pair\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-hardware-bound-device-key-pair\u2461"}, {"id": "ref-for-hardware-bound-device-key-pair\u2462"}, {"id": "ref-for-hardware-bound-device-key-pair\u2463"}, {"id": "ref-for-hardware-bound-device-key-pair\u2464"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-hardware-bound-device-key-pair\u2465"}, {"id": "ref-for-hardware-bound-device-key-pair\u2466"}, {"id": "ref-for-hardware-bound-device-key-pair\u2467"}, {"id": "ref-for-hardware-bound-device-key-pair\u2468"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['device-bound-key'] = {"dfnID": "device-bound-key", "url": "#device-bound-key", "dfnText": "Device-bound Key", "refSections": [{"refs": [{"id": "ref-for-device-bound-key"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-device-bound-key\u2460"}, {"id": "ref-for-device-bound-key\u2461"}, {"id": "ref-for-device-bound-key\u2462"}, {"id": "ref-for-device-bound-key\u2463"}, {"id": "ref-for-device-bound-key\u2464"}, {"id": "ref-for-device-bound-key\u2465"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-device-bound-key\u2466"}, {"id": "ref-for-device-bound-key\u2467"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-device-bound-key\u2468"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-device-bound-key\u2460\u24ea"}, {"id": "ref-for-device-bound-key\u2460\u2460"}, {"id": "ref-for-device-bound-key\u2460\u2461"}, {"id": "ref-for-device-bound-key\u2460\u2462"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-device-bound-key\u2460\u2463"}, {"id": "ref-for-device-bound-key\u2460\u2464"}, {"id": "ref-for-device-bound-key\u2460\u2465"}, {"id": "ref-for-device-bound-key\u2460\u2466"}, {"id": "ref-for-device-bound-key\u2460\u2467"}, {"id": "ref-for-device-bound-key\u2460\u2468"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": false};
-window.dfnpanelData['device-private-key'] = {"dfnID": "device-private-key", "url": "#device-private-key", "dfnText": "Device Private Key", "refSections": [{"refs": [{"id": "ref-for-device-private-key"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-device-private-key\u2460"}, {"id": "ref-for-device-private-key\u2461"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-device-private-key\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-device-private-key\u2463"}], "title": "10.2.2.2.2. Attestation calculations"}], "external": false};
-window.dfnpanelData['device-public-key'] = {"dfnID": "device-public-key", "url": "#device-public-key", "dfnText": "Device Public Key", "refSections": [{"refs": [{"id": "ref-for-device-public-key"}, {"id": "ref-for-device-public-key\u2460"}, {"id": "ref-for-device-public-key\u2461"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-device-public-key\u2462"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-device-public-key\u2463"}, {"id": "ref-for-device-public-key\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-device-public-key\u2465"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-device-public-key\u2466"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-device-public-key\u2467"}, {"id": "ref-for-device-public-key\u2468"}, {"id": "ref-for-device-public-key\u2460\u24ea"}, {"id": "ref-for-device-public-key\u2460\u2460"}, {"id": "ref-for-device-public-key\u2460\u2461"}, {"id": "ref-for-device-public-key\u2460\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['generating-authenticator'] = {"dfnID": "generating-authenticator", "url": "#generating-authenticator", "dfnText": "Generating Authenticator", "refSections": [{"refs": [{"id": "ref-for-generating-authenticator"}, {"id": "ref-for-generating-authenticator\u2460"}, {"id": "ref-for-generating-authenticator\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-generating-authenticator\u2462"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-generating-authenticator\u2463"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-generating-authenticator\u2464"}], "title": "10.2.2.1. Relying Party Usage"}], "external": false};
-window.dfnpanelData['human-palatability'] = {"dfnID": "human-palatability", "url": "#human-palatability", "dfnText": "Human Palatability", "refSections": [{"refs": [{"id": "ref-for-human-palatability"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-human-palatability\u2460"}, {"id": "ref-for-human-palatability\u2461"}, {"id": "ref-for-human-palatability\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-human-palatability\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}], "external": false};
+window.dfnpanelData['supplemental-public-key'] = {"dfnID": "supplemental-public-key", "url": "#supplemental-public-key", "dfnText": "Supplemental public key", "refSections": [{"refs": [{"id": "ref-for-supplemental-public-key"}, {"id": "ref-for-supplemental-public-key\u2460"}, {"id": "ref-for-supplemental-public-key\u2461"}, {"id": "ref-for-supplemental-public-key\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-supplemental-public-key\u2463"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-supplemental-public-key\u2464"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-supplemental-public-key\u2465"}, {"id": "ref-for-supplemental-public-key\u2466"}, {"id": "ref-for-supplemental-public-key\u2467"}, {"id": "ref-for-supplemental-public-key\u2468"}, {"id": "ref-for-supplemental-public-key\u2460\u24ea"}, {"id": "ref-for-supplemental-public-key\u2460\u2460"}, {"id": "ref-for-supplemental-public-key\u2460\u2461"}, {"id": "ref-for-supplemental-public-key\u2460\u2462"}, {"id": "ref-for-supplemental-public-key\u2460\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['generating-authenticator'] = {"dfnID": "generating-authenticator", "url": "#generating-authenticator", "dfnText": "Generating Authenticator", "refSections": [{"refs": [{"id": "ref-for-generating-authenticator"}, {"id": "ref-for-generating-authenticator\u2460"}, {"id": "ref-for-generating-authenticator\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-generating-authenticator\u2462"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-generating-authenticator\u2463"}], "title": "6.5.1. Attestation in assertions"}], "external": false};
+window.dfnpanelData['human-palatability'] = {"dfnID": "human-palatability", "url": "#human-palatability", "dfnText": "Human Palatability", "refSections": [{"refs": [{"id": "ref-for-human-palatability"}, {"id": "ref-for-human-palatability\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-human-palatability\u2461"}, {"id": "ref-for-human-palatability\u2462"}, {"id": "ref-for-human-palatability\u2463"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-human-palatability\u2464"}, {"id": "ref-for-human-palatability\u2465"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-human-palatability\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['non-discoverable-credential'] = {"dfnID": "non-discoverable-credential", "url": "#non-discoverable-credential", "dfnText": "Non-Discoverable Credential", "refSections": [{"refs": [{"id": "ref-for-non-discoverable-credential"}, {"id": "ref-for-non-discoverable-credential\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-non-discoverable-credential\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['public-key-credential'] = {"dfnID": "public-key-credential", "url": "#public-key-credential", "dfnText": "Public Key Credential", "refSections": [{"refs": [{"id": "ref-for-public-key-credential\u2461"}, {"id": "ref-for-public-key-credential\u2462"}, {"id": "ref-for-public-key-credential\u2463"}, {"id": "ref-for-public-key-credential\u2464"}, {"id": "ref-for-public-key-credential\u2465"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-public-key-credential\u2466"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-public-key-credential\u2467"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-public-key-credential\u2468"}, {"id": "ref-for-public-key-credential\u2460\u24ea"}, {"id": "ref-for-public-key-credential\u2460\u2460"}, {"id": "ref-for-public-key-credential\u2460\u2461"}, {"id": "ref-for-public-key-credential\u2460\u2462"}, {"id": "ref-for-public-key-credential\u2460\u2463"}, {"id": "ref-for-public-key-credential\u2460\u2464"}, {"id": "ref-for-public-key-credential\u2460\u2465"}, {"id": "ref-for-public-key-credential\u2460\u2466"}, {"id": "ref-for-public-key-credential\u2460\u2467"}, {"id": "ref-for-public-key-credential\u2460\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u24ea"}, {"id": "ref-for-public-key-credential\u2461\u2460"}, {"id": "ref-for-public-key-credential\u2461\u2461"}, {"id": "ref-for-public-key-credential\u2461\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2464"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2465"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2466"}, {"id": "ref-for-public-key-credential\u2461\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential\u2461\u2468"}, {"id": "ref-for-public-key-credential\u2462\u24ea"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2460"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2462"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2463"}], "title": "5.8. Supporting Data Structures"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2464"}, {"id": "ref-for-public-key-credential\u2462\u2465"}, {"id": "ref-for-public-key-credential\u2462\u2466"}, {"id": "ref-for-public-key-credential\u2462\u2467"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-public-key-credential\u2462\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u24ea"}, {"id": "ref-for-public-key-credential\u2463\u2460"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2461"}, {"id": "ref-for-public-key-credential\u2463\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2463"}, {"id": "ref-for-public-key-credential\u2463\u2464"}, {"id": "ref-for-public-key-credential\u2463\u2465"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential\u2463\u2468"}, {"id": "ref-for-public-key-credential\u2464\u24ea"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2460"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2465"}, {"id": "ref-for-public-key-credential\u2464\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-public-key-credential\u2464\u2468"}, {"id": "ref-for-public-key-credential\u2465\u24ea"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2460"}, {"id": "ref-for-public-key-credential\u2465\u2461"}, {"id": "ref-for-public-key-credential\u2465\u2462"}, {"id": "ref-for-public-key-credential\u2465\u2463"}, {"id": "ref-for-public-key-credential\u2465\u2464"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2465"}, {"id": "ref-for-public-key-credential\u2465\u2466"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-public-key-credential\u2465\u2467"}, {"id": "ref-for-public-key-credential\u2465\u2468"}, {"id": "ref-for-public-key-credential\u2466\u24ea"}, {"id": "ref-for-public-key-credential\u2466\u2460"}, {"id": "ref-for-public-key-credential\u2466\u2461"}, {"id": "ref-for-public-key-credential\u2466\u2462"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2463"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2464"}, {"id": "ref-for-public-key-credential\u2466\u2465"}, {"id": "ref-for-public-key-credential\u2466\u2466"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-public-key-credential\u2466\u2467"}, {"id": "ref-for-public-key-credential\u2466\u2468"}, {"id": "ref-for-public-key-credential\u2467\u24ea"}, {"id": "ref-for-public-key-credential\u2467\u2460"}, {"id": "ref-for-public-key-credential\u2467\u2461"}], "title": "14.5.2. Authentication Ceremony Privacy"}], "external": false};
-window.dfnpanelData['public-key-credential-source'] = {"dfnID": "public-key-credential-source", "url": "#public-key-credential-source", "dfnText": "Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source"}, {"id": "ref-for-public-key-credential-source\u2460"}, {"id": "ref-for-public-key-credential-source\u2461"}, {"id": "ref-for-public-key-credential-source\u2462"}, {"id": "ref-for-public-key-credential-source\u2463"}, {"id": "ref-for-public-key-credential-source\u2464"}, {"id": "ref-for-public-key-credential-source\u2465"}, {"id": "ref-for-public-key-credential-source\u2466"}, {"id": "ref-for-public-key-credential-source\u2467"}, {"id": "ref-for-public-key-credential-source\u2468"}, {"id": "ref-for-public-key-credential-source\u2460\u24ea"}, {"id": "ref-for-public-key-credential-source\u2460\u2460"}, {"id": "ref-for-public-key-credential-source\u2460\u2461"}, {"id": "ref-for-public-key-credential-source\u2460\u2462"}, {"id": "ref-for-public-key-credential-source\u2460\u2463"}, {"id": "ref-for-public-key-credential-source\u2460\u2464"}, {"id": "ref-for-public-key-credential-source\u2460\u2465"}, {"id": "ref-for-public-key-credential-source\u2460\u2466"}, {"id": "ref-for-public-key-credential-source\u2460\u2467"}, {"id": "ref-for-public-key-credential-source\u2460\u2468"}, {"id": "ref-for-public-key-credential-source\u2461\u24ea"}, {"id": "ref-for-public-key-credential-source\u2461\u2460"}, {"id": "ref-for-public-key-credential-source\u2461\u2461"}, {"id": "ref-for-public-key-credential-source\u2461\u2462"}, {"id": "ref-for-public-key-credential-source\u2461\u2463"}, {"id": "ref-for-public-key-credential-source\u2461\u2464"}, {"id": "ref-for-public-key-credential-source\u2461\u2465"}, {"id": "ref-for-public-key-credential-source\u2461\u2466"}, {"id": "ref-for-public-key-credential-source\u2461\u2467"}, {"id": "ref-for-public-key-credential-source\u2461\u2468"}, {"id": "ref-for-public-key-credential-source\u2462\u24ea"}, {"id": "ref-for-public-key-credential-source\u2462\u2460"}, {"id": "ref-for-public-key-credential-source\u2462\u2461"}, {"id": "ref-for-public-key-credential-source\u2462\u2462"}, {"id": "ref-for-public-key-credential-source\u2462\u2463"}, {"id": "ref-for-public-key-credential-source\u2462\u2464"}, {"id": "ref-for-public-key-credential-source\u2462\u2465"}, {"id": "ref-for-public-key-credential-source\u2462\u2466"}, {"id": "ref-for-public-key-credential-source\u2462\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2462\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u24ea"}, {"id": "ref-for-public-key-credential-source\u2463\u2460"}, {"id": "ref-for-public-key-credential-source\u2463\u2461"}, {"id": "ref-for-public-key-credential-source\u2463\u2462"}, {"id": "ref-for-public-key-credential-source\u2463\u2463"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2465"}, {"id": "ref-for-public-key-credential-source\u2463\u2466"}, {"id": "ref-for-public-key-credential-source\u2463\u2467"}, {"id": "ref-for-public-key-credential-source\u2463\u2468"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u24ea"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2460"}, {"id": "ref-for-public-key-credential-source\u2464\u2461"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2462"}, {"id": "ref-for-public-key-credential-source\u2464\u2463"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2465"}, {"id": "ref-for-public-key-credential-source\u2464\u2466"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2467"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u24ea"}, {"id": "ref-for-public-key-credential-source\u2465\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2461"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2462"}, {"id": "ref-for-public-key-credential-source\u2465\u2463"}, {"id": "ref-for-public-key-credential-source\u2465\u2464"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2465"}, {"id": "ref-for-public-key-credential-source\u2465\u2466"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2467"}, {"id": "ref-for-public-key-credential-source\u2465\u2468"}, {"id": "ref-for-public-key-credential-source\u2466\u24ea"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u2460"}, {"id": "ref-for-public-key-credential-source\u2466\u2461"}], "title": "11.8. Remove All Credentials"}], "external": false};
+window.dfnpanelData['public-key-credential-source'] = {"dfnID": "public-key-credential-source", "url": "#public-key-credential-source", "dfnText": "Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source"}, {"id": "ref-for-public-key-credential-source\u2460"}, {"id": "ref-for-public-key-credential-source\u2461"}, {"id": "ref-for-public-key-credential-source\u2462"}, {"id": "ref-for-public-key-credential-source\u2463"}, {"id": "ref-for-public-key-credential-source\u2464"}, {"id": "ref-for-public-key-credential-source\u2465"}, {"id": "ref-for-public-key-credential-source\u2466"}, {"id": "ref-for-public-key-credential-source\u2467"}, {"id": "ref-for-public-key-credential-source\u2468"}, {"id": "ref-for-public-key-credential-source\u2460\u24ea"}, {"id": "ref-for-public-key-credential-source\u2460\u2460"}, {"id": "ref-for-public-key-credential-source\u2460\u2461"}, {"id": "ref-for-public-key-credential-source\u2460\u2462"}, {"id": "ref-for-public-key-credential-source\u2460\u2463"}, {"id": "ref-for-public-key-credential-source\u2460\u2464"}, {"id": "ref-for-public-key-credential-source\u2460\u2465"}, {"id": "ref-for-public-key-credential-source\u2460\u2466"}, {"id": "ref-for-public-key-credential-source\u2460\u2467"}, {"id": "ref-for-public-key-credential-source\u2460\u2468"}, {"id": "ref-for-public-key-credential-source\u2461\u24ea"}, {"id": "ref-for-public-key-credential-source\u2461\u2460"}, {"id": "ref-for-public-key-credential-source\u2461\u2461"}, {"id": "ref-for-public-key-credential-source\u2461\u2462"}, {"id": "ref-for-public-key-credential-source\u2461\u2463"}, {"id": "ref-for-public-key-credential-source\u2461\u2464"}, {"id": "ref-for-public-key-credential-source\u2461\u2465"}, {"id": "ref-for-public-key-credential-source\u2461\u2466"}, {"id": "ref-for-public-key-credential-source\u2461\u2467"}, {"id": "ref-for-public-key-credential-source\u2461\u2468"}, {"id": "ref-for-public-key-credential-source\u2462\u24ea"}, {"id": "ref-for-public-key-credential-source\u2462\u2460"}, {"id": "ref-for-public-key-credential-source\u2462\u2461"}, {"id": "ref-for-public-key-credential-source\u2462\u2462"}, {"id": "ref-for-public-key-credential-source\u2462\u2463"}, {"id": "ref-for-public-key-credential-source\u2462\u2464"}, {"id": "ref-for-public-key-credential-source\u2462\u2465"}, {"id": "ref-for-public-key-credential-source\u2462\u2466"}, {"id": "ref-for-public-key-credential-source\u2462\u2467"}, {"id": "ref-for-public-key-credential-source\u2462\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u24ea"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2460"}, {"id": "ref-for-public-key-credential-source\u2463\u2461"}, {"id": "ref-for-public-key-credential-source\u2463\u2462"}, {"id": "ref-for-public-key-credential-source\u2463\u2463"}, {"id": "ref-for-public-key-credential-source\u2463\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2463\u2466"}, {"id": "ref-for-public-key-credential-source\u2463\u2467"}, {"id": "ref-for-public-key-credential-source\u2463\u2468"}, {"id": "ref-for-public-key-credential-source\u2464\u24ea"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2460"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2461"}, {"id": "ref-for-public-key-credential-source\u2464\u2462"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2463"}, {"id": "ref-for-public-key-credential-source\u2464\u2464"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2466"}, {"id": "ref-for-public-key-credential-source\u2464\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2464\u2468"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2461"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2462"}, {"id": "ref-for-public-key-credential-source\u2465\u2463"}, {"id": "ref-for-public-key-credential-source\u2465\u2464"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2465"}, {"id": "ref-for-public-key-credential-source\u2465\u2466"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2465\u2467"}, {"id": "ref-for-public-key-credential-source\u2465\u2468"}, {"id": "ref-for-public-key-credential-source\u2466\u24ea"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-public-key-credential-source\u2466\u2460"}, {"id": "ref-for-public-key-credential-source\u2466\u2461"}], "title": "11.8. Remove All Credentials"}], "external": false};
 window.dfnpanelData['public-key-credential-source-type'] = {"dfnID": "public-key-credential-source-type", "url": "#public-key-credential-source-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2460"}, {"id": "ref-for-public-key-credential-source-type\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-type\u2463"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['public-key-credential-source-id'] = {"dfnID": "public-key-credential-source-id", "url": "#public-key-credential-source-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-id"}, {"id": "ref-for-public-key-credential-source-id\u2460"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-public-key-credential-source-id\u2465"}, {"id": "ref-for-public-key-credential-source-id\u2466"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['public-key-credential-source-privatekey'] = {"dfnID": "public-key-credential-source-privatekey", "url": "#public-key-credential-source-privatekey", "dfnText": "privateKey", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-privatekey"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-privatekey\u2460"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-privatekey\u2461"}, {"id": "ref-for-public-key-credential-source-privatekey\u2462"}], "title": "11.5. Add Credential"}], "external": false};
@@ -11198,11 +11334,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['public-key-credential-source-userhandle'] = {"dfnID": "public-key-credential-source-userhandle", "url": "#public-key-credential-source-userhandle", "dfnText": "userHandle", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-userhandle"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-public-key-credential-source-userhandle\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-userhandle\u2461"}, {"id": "ref-for-public-key-credential-source-userhandle\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-userhandle\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-userhandle\u2464"}, {"id": "ref-for-public-key-credential-source-userhandle\u2465"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['public-key-credential-source-otherui'] = {"dfnID": "public-key-credential-source-otherui", "url": "#public-key-credential-source-otherui", "dfnText": "otherUI", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-otherui"}, {"id": "ref-for-public-key-credential-source-otherui\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source-otherui\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-public-key-credential-source-otherui\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
 window.dfnpanelData['public-key-credential-source-mutable-item'] = {"dfnID": "public-key-credential-source-mutable-item", "url": "#public-key-credential-source-mutable-item", "dfnText": "mutable item", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-mutable-item"}], "title": "4. Terminology"}], "external": false};
-window.dfnpanelData['public-key-credential-source-managing-authenticator'] = {"dfnID": "public-key-credential-source-managing-authenticator", "url": "#public-key-credential-source-managing-authenticator", "dfnText": "managing authenticator", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2460"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2461"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2462"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2463"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2464"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2465"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2466"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2468"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u2461"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": false};
+window.dfnpanelData['public-key-credential-source-managing-authenticator'] = {"dfnID": "public-key-credential-source-managing-authenticator", "url": "#public-key-credential-source-managing-authenticator", "dfnText": "managing authenticator", "refSections": [{"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2460"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2461"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2462"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2463"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2464"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2465"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2466"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2468"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u2461"}, {"id": "ref-for-public-key-credential-source-managing-authenticator\u2460\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['rate-limiting'] = {"dfnID": "rate-limiting", "url": "#rate-limiting", "dfnText": "Rate Limiting", "refSections": [{"refs": [{"id": "ref-for-rate-limiting"}, {"id": "ref-for-rate-limiting\u2460"}], "title": "4. Terminology"}], "external": false};
-window.dfnpanelData['registration'] = {"dfnID": "registration", "url": "#registration", "dfnText": "Registration", "refSections": [{"refs": [{"id": "ref-for-registration"}, {"id": "ref-for-registration\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-registration\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-registration\u2462"}, {"id": "ref-for-registration\u2463"}, {"id": "ref-for-registration\u2464"}, {"id": "ref-for-registration\u2465"}, {"id": "ref-for-registration\u2466"}, {"id": "ref-for-registration\u2467"}, {"id": "ref-for-registration\u2468"}, {"id": "ref-for-registration\u2460\u24ea"}, {"id": "ref-for-registration\u2460\u2460"}, {"id": "ref-for-registration\u2460\u2461"}, {"id": "ref-for-registration\u2460\u2462"}, {"id": "ref-for-registration\u2460\u2463"}, {"id": "ref-for-registration\u2460\u2464"}, {"id": "ref-for-registration\u2460\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration\u2460\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-registration\u2460\u2467"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-registration\u2460\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration\u2461\u24ea"}, {"id": "ref-for-registration\u2461\u2460"}, {"id": "ref-for-registration\u2461\u2461"}, {"id": "ref-for-registration\u2461\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration\u2461\u2463"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2464"}, {"id": "ref-for-registration\u2461\u2465"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-registration\u2461\u2466"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-registration\u2461\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-registration\u2461\u2468"}], "title": "15. Accessibility Considerations"}, {"refs": [{"id": "ref-for-registration\u2462\u24ea"}], "title": "16. Acknowledgements"}], "external": false};
-window.dfnpanelData['registration-ceremony'] = {"dfnID": "registration-ceremony", "url": "#registration-ceremony", "dfnText": "Registration Ceremony", "refSections": [{"refs": [{"id": "ref-for-registration-ceremony"}, {"id": "ref-for-registration-ceremony\u2460"}, {"id": "ref-for-registration-ceremony\u2461"}, {"id": "ref-for-registration-ceremony\u2462"}, {"id": "ref-for-registration-ceremony\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration-ceremony\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-registration-ceremony\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2466"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-registration-ceremony\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u24ea"}, {"id": "ref-for-registration-ceremony\u2460\u2460"}, {"id": "ref-for-registration-ceremony\u2460\u2461"}, {"id": "ref-for-registration-ceremony\u2460\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2463"}, {"id": "ref-for-registration-ceremony\u2460\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2465"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2467"}, {"id": "ref-for-registration-ceremony\u2460\u2468"}, {"id": "ref-for-registration-ceremony\u2461\u24ea"}, {"id": "ref-for-registration-ceremony\u2461\u2460"}, {"id": "ref-for-registration-ceremony\u2461\u2461"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-registration-ceremony\u2461\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2462"}, {"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u24ea"}, {"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2464"}, {"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2462"}, {"id": "ref-for-relying-party\u2460\u24ea\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2467"}, {"id": "ref-for-relying-party\u2460\u24ea\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}, {"id": "ref-for-relying-party\u2460\u2460\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2466"}, {"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}, {"id": "ref-for-relying-party\u2460\u2461\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2467"}, {"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}, {"id": "ref-for-relying-party\u2460\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2463"}, {"id": "ref-for-relying-party\u2460\u2462\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2465"}, {"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}, {"id": "ref-for-relying-party\u2460\u2462\u2468"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u24ea"}, {"id": "ref-for-relying-party\u2460\u2463\u2460"}, {"id": "ref-for-relying-party\u2460\u2463\u2461"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2462"}, {"id": "ref-for-relying-party\u2460\u2463\u2463"}, {"id": "ref-for-relying-party\u2460\u2463\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2465"}, {"id": "ref-for-relying-party\u2460\u2463\u2466"}, {"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}, {"id": "ref-for-relying-party\u2460\u2464\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2461"}, {"id": "ref-for-relying-party\u2460\u2464\u2462"}, {"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}, {"id": "ref-for-relying-party\u2460\u2464\u2468"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465\u24ea"}, {"id": "ref-for-relying-party\u2460\u2465\u2460"}, {"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}, {"id": "ref-for-relying-party\u2460\u2466\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2460"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2461"}, {"id": "ref-for-relying-party\u2460\u2466\u2462"}, {"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}, {"id": "ref-for-relying-party\u2460\u2466\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2466"}, {"id": "ref-for-relying-party\u2460\u2466\u2467"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u24ea"}, {"id": "ref-for-relying-party\u2460\u2467\u2460"}, {"id": "ref-for-relying-party\u2460\u2467\u2461"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2462"}, {"id": "ref-for-relying-party\u2460\u2467\u2463"}, {"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}, {"id": "ref-for-relying-party\u2460\u2467\u2466"}, {"id": "ref-for-relying-party\u2460\u2467\u2467"}, {"id": "ref-for-relying-party\u2460\u2467\u2468"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u24ea"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2460"}, {"id": "ref-for-relying-party\u2460\u2468\u2461"}, {"id": "ref-for-relying-party\u2460\u2468\u2462"}, {"id": "ref-for-relying-party\u2460\u2468\u2463"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2464"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2465"}, {"id": "ref-for-relying-party\u2460\u2468\u2466"}, {"id": "ref-for-relying-party\u2460\u2468\u2467"}, {"id": "ref-for-relying-party\u2460\u2468\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea\u24ea"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2460"}, {"id": "ref-for-relying-party\u2461\u24ea\u2461"}, {"id": "ref-for-relying-party\u2461\u24ea\u2462"}, {"id": "ref-for-relying-party\u2461\u24ea\u2463"}, {"id": "ref-for-relying-party\u2461\u24ea\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2465"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2466"}, {"id": "ref-for-relying-party\u2461\u24ea\u2467"}, {"id": "ref-for-relying-party\u2461\u24ea\u2468"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460\u2460"}, {"id": "ref-for-relying-party\u2461\u2460\u2461"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2462"}, {"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}, {"id": "ref-for-relying-party\u2461\u2460\u2465"}, {"id": "ref-for-relying-party\u2461\u2460\u2466"}, {"id": "ref-for-relying-party\u2461\u2460\u2467"}, {"id": "ref-for-relying-party\u2461\u2460\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2461\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2463"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2461\u2465"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2461\u2468"}, {"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}, {"id": "ref-for-relying-party\u2461\u2462\u2463"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2464"}, {"id": "ref-for-relying-party\u2461\u2462\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2466"}, {"id": "ref-for-relying-party\u2461\u2462\u2467"}, {"id": "ref-for-relying-party\u2461\u2462\u2468"}, {"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2461"}, {"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}, {"id": "ref-for-relying-party\u2461\u2463\u2464"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2465"}, {"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}, {"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}, {"id": "ref-for-relying-party\u2461\u2465\u2463"}, {"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2466\u2461"}, {"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}, {"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}, {"id": "ref-for-relying-party\u2461\u2467\u2462"}, {"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}, {"id": "ref-for-relying-party\u2461\u2467\u2465"}, {"id": "ref-for-relying-party\u2461\u2467\u2466"}, {"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}, {"id": "ref-for-relying-party\u2461\u2468\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2460"}, {"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2464"}, {"id": "ref-for-relying-party\u2461\u2468\u2465"}, {"id": "ref-for-relying-party\u2461\u2468\u2466"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2467"}, {"id": "ref-for-relying-party\u2461\u2468\u2468"}, {"id": "ref-for-relying-party\u2462\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2462\u24ea\u2460"}, {"id": "ref-for-relying-party\u2462\u24ea\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2462"}, {"id": "ref-for-relying-party\u2462\u24ea\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2464"}, {"id": "ref-for-relying-party\u2462\u24ea\u2465"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2466"}, {"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}, {"id": "ref-for-relying-party\u2462\u2460\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2460"}, {"id": "ref-for-relying-party\u2462\u2460\u2461"}, {"id": "ref-for-relying-party\u2462\u2460\u2462"}, {"id": "ref-for-relying-party\u2462\u2460\u2463"}, {"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}, {"id": "ref-for-relying-party\u2462\u2460\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u24ea"}, {"id": "ref-for-relying-party\u2462\u2461\u2460"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}, {"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}, {"id": "ref-for-relying-party\u2462\u2461\u2465"}, {"id": "ref-for-relying-party\u2462\u2461\u2466"}, {"id": "ref-for-relying-party\u2462\u2461\u2467"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2468"}, {"id": "ref-for-relying-party\u2462\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2462\u2460"}, {"id": "ref-for-relying-party\u2462\u2462\u2461"}, {"id": "ref-for-relying-party\u2462\u2462\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2463"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2464"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2462\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}, {"id": "ref-for-relying-party\u2462\u2463\u2461"}, {"id": "ref-for-relying-party\u2462\u2463\u2462"}, {"id": "ref-for-relying-party\u2462\u2463\u2463"}, {"id": "ref-for-relying-party\u2462\u2463\u2464"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2465"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2466"}, {"id": "ref-for-relying-party\u2462\u2463\u2467"}, {"id": "ref-for-relying-party\u2462\u2463\u2468"}, {"id": "ref-for-relying-party\u2462\u2464\u24ea"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2462"}, {"id": "ref-for-relying-party\u2462\u2464\u2463"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2464"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2465"}, {"id": "ref-for-relying-party\u2462\u2464\u2466"}, {"id": "ref-for-relying-party\u2462\u2464\u2467"}, {"id": "ref-for-relying-party\u2462\u2464\u2468"}, {"id": "ref-for-relying-party\u2462\u2465\u24ea"}, {"id": "ref-for-relying-party\u2462\u2465\u2460"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}, {"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2465"}, {"id": "ref-for-relying-party\u2462\u2465\u2466"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2467"}, {"id": "ref-for-relying-party\u2462\u2465\u2468"}, {"id": "ref-for-relying-party\u2462\u2466\u24ea"}, {"id": "ref-for-relying-party\u2462\u2466\u2460"}, {"id": "ref-for-relying-party\u2462\u2466\u2461"}, {"id": "ref-for-relying-party\u2462\u2466\u2462"}, {"id": "ref-for-relying-party\u2462\u2466\u2463"}, {"id": "ref-for-relying-party\u2462\u2466\u2464"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2465"}, {"id": "ref-for-relying-party\u2462\u2466\u2466"}, {"id": "ref-for-relying-party\u2462\u2466\u2467"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}, {"id": "ref-for-relying-party\u2462\u2467\u2460"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2463"}, {"id": "ref-for-relying-party\u2462\u2467\u2464"}, {"id": "ref-for-relying-party\u2462\u2467\u2465"}, {"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}, {"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2462"}, {"id": "ref-for-relying-party\u2462\u2468\u2463"}, {"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u24ea"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2460"}, {"id": "ref-for-relying-party\u2463\u24ea\u2461"}, {"id": "ref-for-relying-party\u2463\u24ea\u2462"}, {"id": "ref-for-relying-party\u2463\u24ea\u2463"}, {"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2467"}, {"id": "ref-for-relying-party\u2463\u24ea\u2468"}, {"id": "ref-for-relying-party\u2463\u2460\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460\u2460"}, {"id": "ref-for-relying-party\u2463\u2460\u2461"}, {"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}, {"id": "ref-for-relying-party\u2463\u2460\u2464"}, {"id": "ref-for-relying-party\u2463\u2460\u2465"}, {"id": "ref-for-relying-party\u2463\u2460\u2466"}, {"id": "ref-for-relying-party\u2463\u2460\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}, {"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}, {"id": "ref-for-relying-party\u2463\u2461\u2465"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}, {"id": "ref-for-relying-party\u2463\u2461\u2468"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u24ea"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2460"}, {"id": "ref-for-relying-party\u2463\u2462\u2461"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}, {"id": "ref-for-relying-party\u2463\u2462\u2464"}, {"id": "ref-for-relying-party\u2463\u2462\u2465"}, {"id": "ref-for-relying-party\u2463\u2462\u2466"}, {"id": "ref-for-relying-party\u2463\u2462\u2467"}, {"id": "ref-for-relying-party\u2463\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463\u2463"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2463\u2468"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2464\u24ea"}, {"id": "ref-for-relying-party\u2463\u2464\u2460"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['registration'] = {"dfnID": "registration", "url": "#registration", "dfnText": "Registration", "refSections": [{"refs": [{"id": "ref-for-registration"}, {"id": "ref-for-registration\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-registration\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-registration\u2462"}, {"id": "ref-for-registration\u2463"}, {"id": "ref-for-registration\u2464"}, {"id": "ref-for-registration\u2465"}, {"id": "ref-for-registration\u2466"}, {"id": "ref-for-registration\u2467"}, {"id": "ref-for-registration\u2468"}, {"id": "ref-for-registration\u2460\u24ea"}, {"id": "ref-for-registration\u2460\u2460"}, {"id": "ref-for-registration\u2460\u2461"}, {"id": "ref-for-registration\u2460\u2462"}, {"id": "ref-for-registration\u2460\u2463"}, {"id": "ref-for-registration\u2460\u2464"}, {"id": "ref-for-registration\u2460\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration\u2460\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-registration\u2460\u2467"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-registration\u2460\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration\u2461\u24ea"}, {"id": "ref-for-registration\u2461\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration\u2461\u2461"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2462"}, {"id": "ref-for-registration\u2461\u2463"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-registration\u2461\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-registration\u2461\u2465"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-registration\u2461\u2466"}], "title": "15. Accessibility Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2467"}], "title": "16. Acknowledgements"}], "external": false};
+window.dfnpanelData['registration-ceremony'] = {"dfnID": "registration-ceremony", "url": "#registration-ceremony", "dfnText": "Registration Ceremony", "refSections": [{"refs": [{"id": "ref-for-registration-ceremony"}, {"id": "ref-for-registration-ceremony\u2460"}, {"id": "ref-for-registration-ceremony\u2461"}, {"id": "ref-for-registration-ceremony\u2462"}, {"id": "ref-for-registration-ceremony\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration-ceremony\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-registration-ceremony\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2466"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-registration-ceremony\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u24ea"}, {"id": "ref-for-registration-ceremony\u2460\u2460"}, {"id": "ref-for-registration-ceremony\u2460\u2461"}, {"id": "ref-for-registration-ceremony\u2460\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2463"}, {"id": "ref-for-registration-ceremony\u2460\u2464"}, {"id": "ref-for-registration-ceremony\u2460\u2465"}, {"id": "ref-for-registration-ceremony\u2460\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2467"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2468"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2461\u24ea"}, {"id": "ref-for-registration-ceremony\u2461\u2460"}, {"id": "ref-for-registration-ceremony\u2461\u2461"}, {"id": "ref-for-registration-ceremony\u2461\u2462"}, {"id": "ref-for-registration-ceremony\u2461\u2463"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-registration-ceremony\u2461\u2464"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
+window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}, {"id": "ref-for-relying-party\u2467\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}, {"id": "ref-for-relying-party\u2468\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}, {"id": "ref-for-relying-party\u2468\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}, {"id": "ref-for-relying-party\u2468\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}, {"id": "ref-for-relying-party\u2460\u24ea\u2462"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2463"}, {"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2467"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2468"}, {"id": "ref-for-relying-party\u2460\u2460\u24ea"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}, {"id": "ref-for-relying-party\u2460\u2460\u2465"}, {"id": "ref-for-relying-party\u2460\u2460\u2466"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}, {"id": "ref-for-relying-party\u2460\u2461\u2466"}, {"id": "ref-for-relying-party\u2460\u2461\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}, {"id": "ref-for-relying-party\u2460\u2462\u2462"}, {"id": "ref-for-relying-party\u2460\u2462\u2463"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2464"}, {"id": "ref-for-relying-party\u2460\u2462\u2465"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}, {"id": "ref-for-relying-party\u2460\u2462\u2468"}, {"id": "ref-for-relying-party\u2460\u2463\u24ea"}, {"id": "ref-for-relying-party\u2460\u2463\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2461"}, {"id": "ref-for-relying-party\u2460\u2463\u2462"}, {"id": "ref-for-relying-party\u2460\u2463\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2464"}, {"id": "ref-for-relying-party\u2460\u2463\u2465"}, {"id": "ref-for-relying-party\u2460\u2463\u2466"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}, {"id": "ref-for-relying-party\u2460\u2464\u2460"}, {"id": "ref-for-relying-party\u2460\u2464\u2461"}, {"id": "ref-for-relying-party\u2460\u2464\u2462"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}, {"id": "ref-for-relying-party\u2460\u2464\u2468"}, {"id": "ref-for-relying-party\u2460\u2465\u24ea"}, {"id": "ref-for-relying-party\u2460\u2465\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}, {"id": "ref-for-relying-party\u2460\u2466\u24ea"}, {"id": "ref-for-relying-party\u2460\u2466\u2460"}, {"id": "ref-for-relying-party\u2460\u2466\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2462"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}, {"id": "ref-for-relying-party\u2460\u2466\u2465"}, {"id": "ref-for-relying-party\u2460\u2466\u2466"}, {"id": "ref-for-relying-party\u2460\u2466\u2467"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2468"}, {"id": "ref-for-relying-party\u2460\u2467\u24ea"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2460"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2461"}, {"id": "ref-for-relying-party\u2460\u2467\u2462"}, {"id": "ref-for-relying-party\u2460\u2467\u2463"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}, {"id": "ref-for-relying-party\u2460\u2467\u2466"}, {"id": "ref-for-relying-party\u2460\u2467\u2467"}, {"id": "ref-for-relying-party\u2460\u2467\u2468"}, {"id": "ref-for-relying-party\u2460\u2468\u24ea"}, {"id": "ref-for-relying-party\u2460\u2468\u2460"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2461"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2462"}, {"id": "ref-for-relying-party\u2460\u2468\u2463"}, {"id": "ref-for-relying-party\u2460\u2468\u2464"}, {"id": "ref-for-relying-party\u2460\u2468\u2465"}, {"id": "ref-for-relying-party\u2460\u2468\u2466"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2461\u24ea\u2460"}, {"id": "ref-for-relying-party\u2461\u24ea\u2461"}, {"id": "ref-for-relying-party\u2461\u24ea\u2462"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2463"}, {"id": "ref-for-relying-party\u2461\u24ea\u2464"}, {"id": "ref-for-relying-party\u2461\u24ea\u2465"}, {"id": "ref-for-relying-party\u2461\u24ea\u2466"}, {"id": "ref-for-relying-party\u2461\u24ea\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2468"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460\u2460"}, {"id": "ref-for-relying-party\u2461\u2460\u2461"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2462"}, {"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2465"}, {"id": "ref-for-relying-party\u2461\u2460\u2466"}, {"id": "ref-for-relying-party\u2461\u2460\u2467"}, {"id": "ref-for-relying-party\u2461\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2461\u2463"}, {"id": "ref-for-relying-party\u2461\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2461\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2466"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2461\u2468"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}, {"id": "ref-for-relying-party\u2461\u2462\u2463"}, {"id": "ref-for-relying-party\u2461\u2462\u2464"}, {"id": "ref-for-relying-party\u2461\u2462\u2465"}, {"id": "ref-for-relying-party\u2461\u2462\u2466"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2467"}, {"id": "ref-for-relying-party\u2461\u2462\u2468"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}, {"id": "ref-for-relying-party\u2461\u2463\u2461"}, {"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2464"}, {"id": "ref-for-relying-party\u2461\u2463\u2465"}, {"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}, {"id": "ref-for-relying-party\u2461\u2465\u2463"}, {"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}, {"id": "ref-for-relying-party\u2461\u2466\u2461"}, {"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}, {"id": "ref-for-relying-party\u2461\u2467\u2462"}, {"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}, {"id": "ref-for-relying-party\u2461\u2467\u2465"}, {"id": "ref-for-relying-party\u2461\u2467\u2466"}, {"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}, {"id": "ref-for-relying-party\u2461\u2468\u24ea"}, {"id": "ref-for-relying-party\u2461\u2468\u2460"}, {"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2463"}, {"id": "ref-for-relying-party\u2461\u2468\u2464"}], "title": "8.2.1. Packed Attestation Statement Certificate Requirements"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2465"}, {"id": "ref-for-relying-party\u2461\u2468\u2466"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2467"}, {"id": "ref-for-relying-party\u2461\u2468\u2468"}, {"id": "ref-for-relying-party\u2462\u24ea\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2460"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2461"}, {"id": "ref-for-relying-party\u2462\u24ea\u2462"}, {"id": "ref-for-relying-party\u2462\u24ea\u2463"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2464"}, {"id": "ref-for-relying-party\u2462\u24ea\u2465"}, {"id": "ref-for-relying-party\u2462\u24ea\u2466"}, {"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2461"}, {"id": "ref-for-relying-party\u2462\u2460\u2462"}, {"id": "ref-for-relying-party\u2462\u2460\u2463"}, {"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2467"}, {"id": "ref-for-relying-party\u2462\u2460\u2468"}, {"id": "ref-for-relying-party\u2462\u2461\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2460"}, {"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}, {"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}, {"id": "ref-for-relying-party\u2462\u2461\u2465"}, {"id": "ref-for-relying-party\u2462\u2461\u2466"}, {"id": "ref-for-relying-party\u2462\u2461\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2462\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2461"}, {"id": "ref-for-relying-party\u2462\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2462\u2464"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2462\u2468"}, {"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}, {"id": "ref-for-relying-party\u2462\u2463\u2461"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2462"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2463"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2464"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2465"}, {"id": "ref-for-relying-party\u2462\u2463\u2466"}, {"id": "ref-for-relying-party\u2462\u2463\u2467"}, {"id": "ref-for-relying-party\u2462\u2463\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u24ea"}, {"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}, {"id": "ref-for-relying-party\u2462\u2464\u2462"}, {"id": "ref-for-relying-party\u2462\u2464\u2463"}, {"id": "ref-for-relying-party\u2462\u2464\u2464"}, {"id": "ref-for-relying-party\u2462\u2464\u2465"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2466"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2467"}, {"id": "ref-for-relying-party\u2462\u2464\u2468"}, {"id": "ref-for-relying-party\u2462\u2465\u24ea"}, {"id": "ref-for-relying-party\u2462\u2465\u2460"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2465"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2466"}, {"id": "ref-for-relying-party\u2462\u2465\u2467"}, {"id": "ref-for-relying-party\u2462\u2465\u2468"}, {"id": "ref-for-relying-party\u2462\u2466\u24ea"}, {"id": "ref-for-relying-party\u2462\u2466\u2460"}, {"id": "ref-for-relying-party\u2462\u2466\u2461"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2462"}, {"id": "ref-for-relying-party\u2462\u2466\u2463"}, {"id": "ref-for-relying-party\u2462\u2466\u2464"}, {"id": "ref-for-relying-party\u2462\u2466\u2465"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2466"}, {"id": "ref-for-relying-party\u2462\u2466\u2467"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}, {"id": "ref-for-relying-party\u2462\u2467\u2460"}, {"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}, {"id": "ref-for-relying-party\u2462\u2467\u2463"}, {"id": "ref-for-relying-party\u2462\u2467\u2464"}, {"id": "ref-for-relying-party\u2462\u2467\u2465"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2462"}, {"id": "ref-for-relying-party\u2462\u2468\u2463"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2463\u24ea\u2460"}, {"id": "ref-for-relying-party\u2463\u24ea\u2461"}, {"id": "ref-for-relying-party\u2463\u24ea\u2462"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2463"}, {"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}, {"id": "ref-for-relying-party\u2463\u24ea\u2467"}, {"id": "ref-for-relying-party\u2463\u24ea\u2468"}, {"id": "ref-for-relying-party\u2463\u2460\u24ea"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2460"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2461"}, {"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}, {"id": "ref-for-relying-party\u2463\u2460\u2464"}, {"id": "ref-for-relying-party\u2463\u2460\u2465"}, {"id": "ref-for-relying-party\u2463\u2460\u2466"}, {"id": "ref-for-relying-party\u2463\u2460\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}, {"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}, {"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}, {"id": "ref-for-relying-party\u2463\u2461\u2465"}, {"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}, {"id": "ref-for-relying-party\u2463\u2461\u2468"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u24ea"}, {"id": "ref-for-relying-party\u2463\u2462\u2460"}, {"id": "ref-for-relying-party\u2463\u2462\u2461"}, {"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2464"}, {"id": "ref-for-relying-party\u2463\u2462\u2465"}, {"id": "ref-for-relying-party\u2463\u2462\u2466"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2467"}, {"id": "ref-for-relying-party\u2463\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u2463\u24ea"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2460"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2463\u2462"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2463\u2468"}, {"id": "ref-for-relying-party\u2463\u2464\u24ea"}, {"id": "ref-for-relying-party\u2463\u2464\u2460"}, {"id": "ref-for-relying-party\u2463\u2464\u2461"}, {"id": "ref-for-relying-party\u2463\u2464\u2462"}, {"id": "ref-for-relying-party\u2463\u2464\u2463"}, {"id": "ref-for-relying-party\u2463\u2464\u2464"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2464\u2465"}, {"id": "ref-for-relying-party\u2463\u2464\u2466"}, {"id": "ref-for-relying-party\u2463\u2464\u2467"}, {"id": "ref-for-relying-party\u2463\u2464\u2468"}, {"id": "ref-for-relying-party\u2463\u2465\u24ea"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2465\u2460"}], "title": "15. Accessibility Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2465\u2461"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
 window.dfnpanelData['webauthn-relying-party'] = {"dfnID": "webauthn-relying-party", "url": "#webauthn-relying-party", "dfnText": "WebAuthn Relying Party", "refSections": [{"refs": [{"id": "ref-for-webauthn-relying-party\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464"}], "title": "2.3. WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2465"}, {"id": "ref-for-webauthn-relying-party\u2466"}, {"id": "ref-for-webauthn-relying-party\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2462"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2463"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2465"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2466"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2468"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2463"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2464"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2467"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2468"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u24ea"}, {"id": "ref-for-webauthn-relying-party\u2462\u2460"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2462"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u24ea"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2460"}, {"id": "ref-for-webauthn-relying-party\u2463\u2461"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2462"}, {"id": "ref-for-webauthn-relying-party\u2463\u2463"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2464"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2465"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2466"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2467"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2468"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u24ea"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2460"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2461"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2462"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2463"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['web-application'] = {"dfnID": "web-application", "url": "#web-application", "dfnText": "web application", "refSections": [{"refs": [{"id": "ref-for-web-application\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-web-application\u2461"}, {"id": "ref-for-web-application\u2462"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-web-application\u2463"}], "title": "11. User Agent Automation"}, {"refs": [{"id": "ref-for-web-application\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-web-application\u2465"}], "title": "13. Security Considerations"}], "external": false};
 window.dfnpanelData['relying-party-identifier'] = {"dfnID": "relying-party-identifier", "url": "#relying-party-identifier", "dfnText": "Relying Party Identifier", "refSections": [{"refs": [{"id": "ref-for-relying-party-identifier"}, {"id": "ref-for-relying-party-identifier\u2460"}, {"id": "ref-for-relying-party-identifier\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
@@ -11213,7 +11349,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['server-side-credential'] = {"dfnID": "server-side-credential", "url": "#server-side-credential", "dfnText": "Server-side Credential", "refSections": [{"refs": [{"id": "ref-for-server-side-credential"}, {"id": "ref-for-server-side-credential\u2460"}, {"id": "ref-for-server-side-credential\u2461"}, {"id": "ref-for-server-side-credential\u2462"}, {"id": "ref-for-server-side-credential\u2463"}, {"id": "ref-for-server-side-credential\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-server-side-credential\u2465"}, {"id": "ref-for-server-side-credential\u2466"}, {"id": "ref-for-server-side-credential\u2467"}, {"id": "ref-for-server-side-credential\u2468"}, {"id": "ref-for-server-side-credential\u2460\u24ea"}, {"id": "ref-for-server-side-credential\u2460\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-server-side-credential\u2460\u2461"}, {"id": "ref-for-server-side-credential\u2460\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-server-side-credential\u2460\u2463"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-server-side-credential\u2460\u2464"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-server-side-credential\u2460\u2465"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
 window.dfnpanelData['non-resident-credential'] = {"dfnID": "non-resident-credential", "url": "#non-resident-credential", "dfnText": "Non-Resident Credential", "refSections": [{"refs": [{"id": "ref-for-non-resident-credential"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['test-of-user-presence'] = {"dfnID": "test-of-user-presence", "url": "#test-of-user-presence", "dfnText": "Test of User Presence", "refSections": [{"refs": [{"id": "ref-for-test-of-user-presence"}, {"id": "ref-for-test-of-user-presence\u2460"}, {"id": "ref-for-test-of-user-presence\u2461"}, {"id": "ref-for-test-of-user-presence\u2462"}, {"id": "ref-for-test-of-user-presence\u2463"}, {"id": "ref-for-test-of-user-presence\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-test-of-user-presence\u2465"}, {"id": "ref-for-test-of-user-presence\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-test-of-user-presence\u2467"}, {"id": "ref-for-test-of-user-presence\u2468"}, {"id": "ref-for-test-of-user-presence\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-test-of-user-presence\u2460\u2460"}, {"id": "ref-for-test-of-user-presence\u2460\u2461"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-test-of-user-presence\u2460\u2462"}], "title": "11.2. Virtual Authenticators"}], "external": false};
-window.dfnpanelData['user-account'] = {"dfnID": "user-account", "url": "#user-account", "dfnText": "User Account", "refSections": [{"refs": [{"id": "ref-for-user-account"}, {"id": "ref-for-user-account\u2460"}, {"id": "ref-for-user-account\u2461"}, {"id": "ref-for-user-account\u2462"}, {"id": "ref-for-user-account\u2463"}, {"id": "ref-for-user-account\u2464"}, {"id": "ref-for-user-account\u2465"}, {"id": "ref-for-user-account\u2466"}, {"id": "ref-for-user-account\u2467"}, {"id": "ref-for-user-account\u2468"}, {"id": "ref-for-user-account\u2460\u24ea"}, {"id": "ref-for-user-account\u2460\u2460"}, {"id": "ref-for-user-account\u2460\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-account\u2460\u2462"}, {"id": "ref-for-user-account\u2460\u2463"}, {"id": "ref-for-user-account\u2460\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-user-account\u2460\u2465"}, {"id": "ref-for-user-account\u2460\u2466"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-user-account\u2460\u2467"}, {"id": "ref-for-user-account\u2460\u2468"}, {"id": "ref-for-user-account\u2461\u24ea"}, {"id": "ref-for-user-account\u2461\u2460"}, {"id": "ref-for-user-account\u2461\u2461"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-user-account\u2461\u2462"}, {"id": "ref-for-user-account\u2461\u2463"}, {"id": "ref-for-user-account\u2461\u2464"}, {"id": "ref-for-user-account\u2461\u2465"}, {"id": "ref-for-user-account\u2461\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-user-account\u2461\u2467"}, {"id": "ref-for-user-account\u2461\u2468"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-user-account\u2462\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-user-account\u2462\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-user-account\u2462\u2461"}, {"id": "ref-for-user-account\u2462\u2462"}, {"id": "ref-for-user-account\u2462\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-user-account\u2462\u2464"}, {"id": "ref-for-user-account\u2462\u2465"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-user-account\u2462\u2466"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-user-account\u2462\u2467"}, {"id": "ref-for-user-account\u2462\u2468"}, {"id": "ref-for-user-account\u2463\u24ea"}, {"id": "ref-for-user-account\u2463\u2460"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-user-account\u2463\u2461"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-user-account\u2463\u2462"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-user-account\u2463\u2463"}, {"id": "ref-for-user-account\u2463\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
+window.dfnpanelData['user-account'] = {"dfnID": "user-account", "url": "#user-account", "dfnText": "User Account", "refSections": [{"refs": [{"id": "ref-for-user-account"}, {"id": "ref-for-user-account\u2460"}, {"id": "ref-for-user-account\u2461"}, {"id": "ref-for-user-account\u2462"}, {"id": "ref-for-user-account\u2463"}, {"id": "ref-for-user-account\u2464"}, {"id": "ref-for-user-account\u2465"}, {"id": "ref-for-user-account\u2466"}, {"id": "ref-for-user-account\u2467"}, {"id": "ref-for-user-account\u2468"}, {"id": "ref-for-user-account\u2460\u24ea"}, {"id": "ref-for-user-account\u2460\u2460"}, {"id": "ref-for-user-account\u2460\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-account\u2460\u2462"}, {"id": "ref-for-user-account\u2460\u2463"}, {"id": "ref-for-user-account\u2460\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-user-account\u2460\u2465"}, {"id": "ref-for-user-account\u2460\u2466"}, {"id": "ref-for-user-account\u2460\u2467"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-user-account\u2460\u2468"}, {"id": "ref-for-user-account\u2461\u24ea"}, {"id": "ref-for-user-account\u2461\u2460"}, {"id": "ref-for-user-account\u2461\u2461"}, {"id": "ref-for-user-account\u2461\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-user-account\u2461\u2463"}, {"id": "ref-for-user-account\u2461\u2464"}, {"id": "ref-for-user-account\u2461\u2465"}, {"id": "ref-for-user-account\u2461\u2466"}, {"id": "ref-for-user-account\u2461\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-user-account\u2461\u2468"}, {"id": "ref-for-user-account\u2462\u24ea"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-user-account\u2462\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-user-account\u2462\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-user-account\u2462\u2462"}, {"id": "ref-for-user-account\u2462\u2463"}, {"id": "ref-for-user-account\u2462\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-user-account\u2462\u2465"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-user-account\u2462\u2466"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-user-account\u2462\u2467"}, {"id": "ref-for-user-account\u2462\u2468"}, {"id": "ref-for-user-account\u2463\u24ea"}, {"id": "ref-for-user-account\u2463\u2460"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-user-account\u2463\u2461"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-user-account\u2463\u2462"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-user-account\u2463\u2463"}, {"id": "ref-for-user-account\u2463\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['user-consent'] = {"dfnID": "user-consent", "url": "#user-consent", "dfnText": "User Consent", "refSections": [{"refs": [{"id": "ref-for-user-consent\u2460"}, {"id": "ref-for-user-consent\u2461"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-user-consent\u2462"}, {"id": "ref-for-user-consent\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-consent\u2464"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-user-consent\u2465"}, {"id": "ref-for-user-consent\u2466"}, {"id": "ref-for-user-consent\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-user-consent\u2468"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-user-consent\u2460\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-user-consent\u2460\u2460"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-user-consent\u2460\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-user-consent\u2460\u2462"}, {"id": "ref-for-user-consent\u2460\u2463"}, {"id": "ref-for-user-consent\u2460\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-user-consent\u2460\u2465"}, {"id": "ref-for-user-consent\u2460\u2466"}, {"id": "ref-for-user-consent\u2460\u2467"}, {"id": "ref-for-user-consent\u2460\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-user-consent\u2461\u24ea"}, {"id": "ref-for-user-consent\u2461\u2460"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-user-consent\u2461\u2461"}, {"id": "ref-for-user-consent\u2461\u2462"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-user-consent\u2461\u2463"}, {"id": "ref-for-user-consent\u2461\u2464"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-user-consent\u2461\u2465"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-user-consent\u2461\u2466"}, {"id": "ref-for-user-consent\u2461\u2467"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-user-consent\u2461\u2468"}, {"id": "ref-for-user-consent\u2462\u24ea"}, {"id": "ref-for-user-consent\u2462\u2460"}], "title": "14.5.2. Authentication Ceremony Privacy"}], "external": false};
 window.dfnpanelData['user-handle'] = {"dfnID": "user-handle", "url": "#user-handle", "dfnText": "User Handle", "refSections": [{"refs": [{"id": "ref-for-user-handle"}], "title": "2.2.1. Backwards Compatibility with FIDO U2F"}, {"refs": [{"id": "ref-for-user-handle\u2460"}, {"id": "ref-for-user-handle\u2461"}, {"id": "ref-for-user-handle\u2462"}, {"id": "ref-for-user-handle\u2463"}, {"id": "ref-for-user-handle\u2464"}, {"id": "ref-for-user-handle\u2465"}, {"id": "ref-for-user-handle\u2466"}, {"id": "ref-for-user-handle\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-handle\u2468"}, {"id": "ref-for-user-handle\u2460\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-user-handle\u2460\u2460"}, {"id": "ref-for-user-handle\u2460\u2461"}, {"id": "ref-for-user-handle\u2460\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-user-handle\u2460\u2463"}, {"id": "ref-for-user-handle\u2460\u2464"}, {"id": "ref-for-user-handle\u2460\u2465"}, {"id": "ref-for-user-handle\u2460\u2466"}, {"id": "ref-for-user-handle\u2460\u2467"}, {"id": "ref-for-user-handle\u2460\u2468"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-user-handle\u2461\u24ea"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2462"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2465"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2466"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-user-handle\u2461\u2467"}, {"id": "ref-for-user-handle\u2461\u2468"}, {"id": "ref-for-user-handle\u2462\u24ea"}, {"id": "ref-for-user-handle\u2462\u2460"}], "title": "14.6.1. User Handle Contents"}], "external": false};
 window.dfnpanelData['concept-user-present'] = {"dfnID": "concept-user-present", "url": "#concept-user-present", "dfnText": "User Present", "refSections": [{"refs": [{"id": "ref-for-concept-user-present"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-user-present\u2460"}, {"id": "ref-for-concept-user-present\u2461"}, {"id": "ref-for-concept-user-present\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-concept-user-present\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}], "external": false};
@@ -11229,13 +11365,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-publickeycredential-authenticatorattachment'] = {"dfnID": "dom-publickeycredential-authenticatorattachment", "url": "#dom-publickeycredential-authenticatorattachment", "dfnText": "authenticatorAttachment", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment"}, {"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
 window.dfnpanelData['typedefdef-base64urlstring'] = {"dfnID": "typedefdef-base64urlstring", "url": "#typedefdef-base64urlstring", "dfnText": "Base64URLString", "refSections": [{"refs": [{"id": "ref-for-typedefdef-base64urlstring"}, {"id": "ref-for-typedefdef-base64urlstring\u2460"}, {"id": "ref-for-typedefdef-base64urlstring\u2461"}, {"id": "ref-for-typedefdef-base64urlstring\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2463"}, {"id": "ref-for-typedefdef-base64urlstring\u2464"}, {"id": "ref-for-typedefdef-base64urlstring\u2465"}, {"id": "ref-for-typedefdef-base64urlstring\u2466"}, {"id": "ref-for-typedefdef-base64urlstring\u2467"}, {"id": "ref-for-typedefdef-base64urlstring\u2468"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u24ea"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2460"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2463"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2465"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
 window.dfnpanelData['typedefdef-publickeycredentialjson'] = {"dfnID": "typedefdef-publickeycredentialjson", "url": "#typedefdef-publickeycredentialjson", "dfnText": "PublicKeyCredentialJSON", "refSections": [{"refs": [{"id": "ref-for-typedefdef-publickeycredentialjson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
-window.dfnpanelData['dictdef-registrationresponsejson'] = {"dfnID": "dictdef-registrationresponsejson", "url": "#dictdef-registrationresponsejson", "dfnText": "RegistrationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-registrationresponsejson"}, {"id": "ref-for-dictdef-registrationresponsejson\u2460"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
+window.dfnpanelData['dictdef-registrationresponsejson'] = {"dfnID": "dictdef-registrationresponsejson", "url": "#dictdef-registrationresponsejson", "dfnText": "RegistrationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-registrationresponsejson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-registrationresponsejson-clientextensionresults'] = {"dfnID": "dom-registrationresponsejson-clientextensionresults", "url": "#dom-registrationresponsejson-clientextensionresults", "dfnText": "clientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-dom-registrationresponsejson-clientextensionresults"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dictdef-authenticatorattestationresponsejson'] = {"dfnID": "dictdef-authenticatorattestationresponsejson", "url": "#dictdef-authenticatorattestationresponsejson", "dfnText": "AuthenticatorAttestationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticatorattestationresponsejson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-authenticatorattestationresponsejson-transports'] = {"dfnID": "dom-authenticatorattestationresponsejson-transports", "url": "#dom-authenticatorattestationresponsejson-transports", "dfnText": "transports", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorattestationresponsejson-transports"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-authenticatorattestationresponsejson-publickey'] = {"dfnID": "dom-authenticatorattestationresponsejson-publickey", "url": "#dom-authenticatorattestationresponsejson-publickey", "dfnText": "publicKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorattestationresponsejson-publickey"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-authenticatorattestationresponsejson-publickeyalgorithm'] = {"dfnID": "dom-authenticatorattestationresponsejson-publickeyalgorithm", "url": "#dom-authenticatorattestationresponsejson-publickeyalgorithm", "dfnText": "publicKeyAlgorithm", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorattestationresponsejson-publickeyalgorithm"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
-window.dfnpanelData['dictdef-authenticationresponsejson'] = {"dfnID": "dictdef-authenticationresponsejson", "url": "#dictdef-authenticationresponsejson", "dfnText": "AuthenticationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationresponsejson"}, {"id": "ref-for-dictdef-authenticationresponsejson\u2460"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
+window.dfnpanelData['dictdef-authenticationresponsejson'] = {"dfnID": "dictdef-authenticationresponsejson", "url": "#dictdef-authenticationresponsejson", "dfnText": "AuthenticationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationresponsejson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-authenticationresponsejson-clientextensionresults'] = {"dfnID": "dom-authenticationresponsejson-clientextensionresults", "url": "#dom-authenticationresponsejson-clientextensionresults", "dfnText": "clientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationresponsejson-clientextensionresults"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dictdef-authenticatorassertionresponsejson'] = {"dfnID": "dictdef-authenticatorassertionresponsejson", "url": "#dictdef-authenticatorassertionresponsejson", "dfnText": "AuthenticatorAssertionResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticatorassertionresponsejson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dictdef-authenticationextensionsclientoutputsjson'] = {"dfnID": "dictdef-authenticationextensionsclientoutputsjson", "url": "#dictdef-authenticationextensionsclientoutputsjson", "dfnText": "AuthenticationExtensionsClientOutputsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsclientoutputsjson"}, {"id": "ref-for-dictdef-authenticationextensionsclientoutputsjson\u2460"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
@@ -11253,7 +11389,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['credentialcreationdata-attestationobjectresult'] = {"dfnID": "credentialcreationdata-attestationobjectresult", "url": "#credentialcreationdata-attestationobjectresult", "dfnText": "attestationObjectResult", "refSections": [{"refs": [{"id": "ref-for-credentialcreationdata-attestationobjectresult"}, {"id": "ref-for-credentialcreationdata-attestationobjectresult\u2460"}, {"id": "ref-for-credentialcreationdata-attestationobjectresult\u2461"}, {"id": "ref-for-credentialcreationdata-attestationobjectresult\u2462"}, {"id": "ref-for-credentialcreationdata-attestationobjectresult\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
 window.dfnpanelData['credentialcreationdata-clientdatajsonresult'] = {"dfnID": "credentialcreationdata-clientdatajsonresult", "url": "#credentialcreationdata-clientdatajsonresult", "dfnText": "clientDataJSONResult", "refSections": [{"refs": [{"id": "ref-for-credentialcreationdata-clientdatajsonresult"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
 window.dfnpanelData['credentialcreationdata-attestationconveyancepreferenceoption'] = {"dfnID": "credentialcreationdata-attestationconveyancepreferenceoption", "url": "#credentialcreationdata-attestationconveyancepreferenceoption", "dfnText": "attestationConveyancePreferenceOption", "refSections": [{"refs": [{"id": "ref-for-credentialcreationdata-attestationconveyancepreferenceoption"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
-window.dfnpanelData['credentialcreationdata-clientextensionresults'] = {"dfnID": "credentialcreationdata-clientextensionresults", "url": "#credentialcreationdata-clientextensionresults", "dfnText": "clientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-credentialcreationdata-clientextensionresults"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-credentialcreationdata-clientextensionresults\u2460"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
+window.dfnpanelData['credentialcreationdata-clientextensionresults'] = {"dfnID": "credentialcreationdata-clientextensionresults", "url": "#credentialcreationdata-clientextensionresults", "dfnText": "clientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-credentialcreationdata-clientextensionresults"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-collectfromcredentialstore-slot'] = {"dfnID": "dom-publickeycredential-collectfromcredentialstore-slot", "url": "#dom-publickeycredential-collectfromcredentialstore-slot", "dfnText": "[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-collectfromcredentialstore-slot"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-discoverfromexternalsource-slot'] = {"dfnID": "dom-publickeycredential-discoverfromexternalsource-slot", "url": "#dom-publickeycredential-discoverfromexternalsource-slot", "dfnText": "[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2462"}, {"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2465"}, {"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2466"}, {"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2467"}, {"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2468"}, {"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u24ea"}], "title": "5.6. Abort Operations with AbortSignal"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2460"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2461"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2462"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-slot\u2460\u2463"}], "title": "14.5.2. Authentication Ceremony Privacy"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin'] = {"dfnID": "dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin", "url": "#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
@@ -11298,7 +11434,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-publickeycredentialcreationoptions-user'] = {"dfnID": "dom-publickeycredentialcreationoptions-user", "url": "#dom-publickeycredentialcreationoptions-user", "dfnText": "user", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2462"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2463"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2466"}], "title": "13.4.6. Credential Loss and Key Mobility"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-challenge'] = {"dfnID": "dom-publickeycredentialcreationoptions-challenge", "url": "#dom-publickeycredentialcreationoptions-challenge", "dfnText": "challenge", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2463"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-pubkeycredparams'] = {"dfnID": "dom-publickeycredentialcreationoptions-pubkeycredparams", "url": "#dom-publickeycredentialcreationoptions-pubkeycredparams", "dfnText": "pubKeyCredParams", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2461"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams\u2463"}], "title": "7.1. Registering a New Credential"}], "external": false};
-window.dfnpanelData['dom-publickeycredentialcreationoptions-timeout'] = {"dfnID": "dom-publickeycredentialcreationoptions-timeout", "url": "#dom-publickeycredentialcreationoptions-timeout", "dfnText": "timeout", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2463"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['dom-publickeycredentialcreationoptions-timeout'] = {"dfnID": "dom-publickeycredentialcreationoptions-timeout", "url": "#dom-publickeycredentialcreationoptions-timeout", "dfnText": "timeout", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-timeout\u2463"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-excludecredentials'] = {"dfnID": "dom-publickeycredentialcreationoptions-excludecredentials", "url": "#dom-publickeycredentialcreationoptions-excludecredentials", "dfnText": "excludeCredentials", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2461"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2462"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-excludecredentials\u2463"}], "title": "14.5.1. Registration Ceremony Privacy"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-authenticatorselection'] = {"dfnID": "dom-publickeycredentialcreationoptions-authenticatorselection", "url": "#dom-publickeycredentialcreationoptions-authenticatorselection", "dfnText": "authenticatorSelection", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2461"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2462"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2463"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2464"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2465"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2468"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-authenticatorselection\u2460\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-hints'] = {"dfnID": "dom-publickeycredentialcreationoptions-hints", "url": "#dom-publickeycredentialcreationoptions-hints", "dfnText": "hints", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-hints"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-hints\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
@@ -11311,7 +11447,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-publickeycredentialrpentity-id'] = {"dfnID": "dom-publickeycredentialrpentity-id", "url": "#dom-publickeycredentialrpentity-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2460"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2461"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2462"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2463"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2464"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2465"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2466"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2468"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": false};
 window.dfnpanelData['dictdef-publickeycredentialuserentity'] = {"dfnID": "dictdef-publickeycredentialuserentity", "url": "#dictdef-publickeycredentialuserentity", "dfnText": "PublicKeyCredentialUserEntity", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity"}, {"id": "ref-for-dictdef-publickeycredentialuserentity\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2462"}, {"id": "ref-for-dictdef-publickeycredentialuserentity\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2465"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2466"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialuserentity-id'] = {"dfnID": "dom-publickeycredentialuserentity-id", "url": "#dom-publickeycredentialuserentity-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2461"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2462"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2463"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2465"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2466"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2468"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": false};
-window.dfnpanelData['dom-publickeycredentialuserentity-displayname'] = {"dfnID": "dom-publickeycredentialuserentity-displayname", "url": "#dom-publickeycredentialuserentity-displayname", "dfnText": "displayName", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2461"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2463"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2464"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2465"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2466"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2467"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2468"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2462"}], "title": "6.4. String Handling"}], "external": false};
+window.dfnpanelData['dom-publickeycredentialuserentity-displayname'] = {"dfnID": "dom-publickeycredentialuserentity-displayname", "url": "#dom-publickeycredentialuserentity-displayname", "dfnText": "displayName", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2461"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2463"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2464"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2465"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2466"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2467"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2468"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2461"}], "title": "6.4. String Handling"}], "external": false};
 window.dfnpanelData['dictdef-authenticatorselectioncriteria'] = {"dfnID": "dictdef-authenticatorselectioncriteria", "url": "#dictdef-authenticatorselectioncriteria", "dfnText": "AuthenticatorSelectionCriteria", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2460"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2462"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
 window.dfnpanelData['dom-authenticatorselectioncriteria-authenticatorattachment'] = {"dfnID": "dom-authenticatorselectioncriteria-authenticatorattachment", "url": "#dom-authenticatorselectioncriteria-authenticatorattachment", "dfnText": "authenticatorAttachment", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2461"}, {"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2462"}, {"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2463"}, {"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2464"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}], "external": false};
 window.dfnpanelData['dom-authenticatorselectioncriteria-residentkey'] = {"dfnID": "dom-authenticatorselectioncriteria-residentkey", "url": "#dom-authenticatorselectioncriteria-residentkey", "dfnText": "residentKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
@@ -11326,16 +11462,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-residentkeyrequirement-required'] = {"dfnID": "dom-residentkeyrequirement-required", "url": "#dom-residentkeyrequirement-required", "dfnText": "required", "refSections": [{"refs": [{"id": "ref-for-dom-residentkeyrequirement-required"}, {"id": "ref-for-dom-residentkeyrequirement-required\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-residentkeyrequirement-required\u2461"}, {"id": "ref-for-dom-residentkeyrequirement-required\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-residentkeyrequirement-required\u2463"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-residentkeyrequirement-required\u2464"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
 window.dfnpanelData['attestation-conveyance'] = {"dfnID": "attestation-conveyance", "url": "#attestation-conveyance", "dfnText": "Attestation Conveyance", "refSections": [{"refs": [{"id": "ref-for-attestation-conveyance"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-conveyance\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation-conveyance\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation-conveyance\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-attestation-conveyance\u2463"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-conveyance\u2464"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['enumdef-attestationconveyancepreference'] = {"dfnID": "enumdef-attestationconveyancepreference", "url": "#enumdef-attestationconveyancepreference", "dfnText": "AttestationConveyancePreference", "refSections": [{"refs": [{"id": "ref-for-enumdef-attestationconveyancepreference"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-enumdef-attestationconveyancepreference"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-enumdef-attestationconveyancepreference\u2460"}, {"id": "ref-for-enumdef-attestationconveyancepreference\u2461"}, {"id": "ref-for-enumdef-attestationconveyancepreference\u2462"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-enumdef-attestationconveyancepreference\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-enumdef-attestationconveyancepreference\u2464"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-attestationconveyancepreference-none'] = {"dfnID": "dom-attestationconveyancepreference-none", "url": "#dom-attestationconveyancepreference-none", "dfnText": "none", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none"}, {"id": "ref-for-dom-attestationconveyancepreference-none\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2463"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2465"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2466"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-attestationconveyancepreference-indirect'] = {"dfnID": "dom-attestationconveyancepreference-indirect", "url": "#dom-attestationconveyancepreference-indirect", "dfnText": "indirect", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}], "external": false};
+window.dfnpanelData['dom-attestationconveyancepreference-none'] = {"dfnID": "dom-attestationconveyancepreference-none", "url": "#dom-attestationconveyancepreference-none", "dfnText": "none", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none"}, {"id": "ref-for-dom-attestationconveyancepreference-none\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2463"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-none\u2465"}], "title": "6.5.4. Attestation Types"}], "external": false};
+window.dfnpanelData['dom-attestationconveyancepreference-indirect'] = {"dfnID": "dom-attestationconveyancepreference-indirect", "url": "#dom-attestationconveyancepreference-indirect", "dfnText": "indirect", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['dom-attestationconveyancepreference-direct'] = {"dfnID": "dom-attestationconveyancepreference-direct", "url": "#dom-attestationconveyancepreference-direct", "dfnText": "direct", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-direct"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-direct\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}], "external": false};
 window.dfnpanelData['dom-attestationconveyancepreference-enterprise'] = {"dfnID": "dom-attestationconveyancepreference-enterprise", "url": "#dom-attestationconveyancepreference-enterprise", "dfnText": "enterprise", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise"}, {"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2462"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": false};
 window.dfnpanelData['dictdef-publickeycredentialrequestoptions'] = {"dfnID": "dictdef-publickeycredentialrequestoptions", "url": "#dictdef-publickeycredentialrequestoptions", "dfnText": "PublicKeyCredentialRequestOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2461"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2463"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2464"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2465"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2466"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2467"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u24ea"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2463"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-challenge'] = {"dfnID": "dom-publickeycredentialrequestoptions-challenge", "url": "#dom-publickeycredentialrequestoptions-challenge", "dfnText": "challenge", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2463"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
-window.dfnpanelData['dom-publickeycredentialrequestoptions-timeout'] = {"dfnID": "dom-publickeycredentialrequestoptions-timeout", "url": "#dom-publickeycredentialrequestoptions-timeout", "dfnText": "timeout", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2463"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['dom-publickeycredentialrequestoptions-timeout'] = {"dfnID": "dom-publickeycredentialrequestoptions-timeout", "url": "#dom-publickeycredentialrequestoptions-timeout", "dfnText": "timeout", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2463"}], "title": "15.1. Recommended Range for Ceremony Timeouts"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-rpid'] = {"dfnID": "dom-publickeycredentialrequestoptions-rpid", "url": "#dom-publickeycredentialrequestoptions-rpid", "dfnText": "rpId", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
-window.dfnpanelData['dom-publickeycredentialrequestoptions-allowcredentials'] = {"dfnID": "dom-publickeycredentialrequestoptions-allowcredentials", "url": "#dom-publickeycredentialrequestoptions-allowcredentials", "dfnText": "allowCredentials", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2464"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2465"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2466"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2467"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2463"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2466"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2468"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u24ea"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2463"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2464"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2465"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2466"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2467"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2468"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u24ea"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2460"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2462"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2463"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2464"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2465"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
-window.dfnpanelData['dom-publickeycredentialrequestoptions-userverification'] = {"dfnID": "dom-publickeycredentialrequestoptions-userverification", "url": "#dom-publickeycredentialrequestoptions-userverification", "dfnText": "userVerification", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
+window.dfnpanelData['dom-publickeycredentialrequestoptions-allowcredentials'] = {"dfnID": "dom-publickeycredentialrequestoptions-allowcredentials", "url": "#dom-publickeycredentialrequestoptions-allowcredentials", "dfnText": "allowCredentials", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2464"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2465"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2466"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2467"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2463"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2465"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2466"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2467"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2460\u2468"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2462"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2463"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2465"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2466"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2467"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2461\u2468"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u24ea"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2460"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2462"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2463"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2464"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2465"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2466"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-allowcredentials\u2462\u2467"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
+window.dfnpanelData['dom-publickeycredentialrequestoptions-userverification'] = {"dfnID": "dom-publickeycredentialrequestoptions-userverification", "url": "#dom-publickeycredentialrequestoptions-userverification", "dfnText": "userVerification", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-userverification\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-hints'] = {"dfnID": "dom-publickeycredentialrequestoptions-hints", "url": "#dom-publickeycredentialrequestoptions-hints", "dfnText": "hints", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-hints"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-hints\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-attestation'] = {"dfnID": "dom-publickeycredentialrequestoptions-attestation", "url": "#dom-publickeycredentialrequestoptions-attestation", "dfnText": "attestation", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-attestation"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-attestation\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-attestation\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-attestation\u2462"}], "title": "6.5.1. Attestation in assertions"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-attestationformats'] = {"dfnID": "dom-publickeycredentialrequestoptions-attestationformats", "url": "#dom-publickeycredentialrequestoptions-attestationformats", "dfnText": "attestationFormats", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-attestationformats"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-attestationformats\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": false};
@@ -11359,7 +11495,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['ccdtostring'] = {"dfnID": "ccdtostring", "url": "#ccdtostring", "dfnText": "CCDToString", "refSections": [{"refs": [{"id": "ref-for-ccdtostring"}, {"id": "ref-for-ccdtostring\u2460"}, {"id": "ref-for-ccdtostring\u2461"}, {"id": "ref-for-ccdtostring\u2462"}], "title": "5.8.1.1. Serialization"}, {"refs": [{"id": "ref-for-ccdtostring\u2463"}, {"id": "ref-for-ccdtostring\u2464"}, {"id": "ref-for-ccdtostring\u2465"}], "title": "5.8.1.2. Limited Verification Algorithm"}], "external": false};
 window.dfnpanelData['enumdef-publickeycredentialtype'] = {"dfnID": "enumdef-publickeycredentialtype", "url": "#enumdef-publickeycredentialtype", "dfnText": "PublicKeyCredentialType", "refSections": [{"refs": [{"id": "ref-for-enumdef-publickeycredentialtype"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2460"}, {"id": "ref-for-enumdef-publickeycredentialtype\u2461"}, {"id": "ref-for-enumdef-publickeycredentialtype\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2463"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2464"}, {"id": "ref-for-enumdef-publickeycredentialtype\u2465"}], "title": "5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2466"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2467"}, {"id": "ref-for-enumdef-publickeycredentialtype\u2468"}, {"id": "ref-for-enumdef-publickeycredentialtype\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-enumdef-publickeycredentialtype\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialtype-public-key'] = {"dfnID": "dom-publickeycredentialtype-public-key", "url": "#dom-publickeycredentialtype-public-key", "dfnText": "public-key", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key\u2460"}, {"id": "ref-for-dom-publickeycredentialtype-public-key\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key\u2462"}], "title": "5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialtype-public-key\u2465"}], "title": "11.5. Add Credential"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialdescriptor'] = {"dfnID": "dictdef-publickeycredentialdescriptor", "url": "#dictdef-publickeycredentialdescriptor", "dfnText": "PublicKeyCredentialDescriptor", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2461"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2462"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2464"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2466"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2468"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialdescriptor'] = {"dfnID": "dictdef-publickeycredentialdescriptor", "url": "#dictdef-publickeycredentialdescriptor", "dfnText": "PublicKeyCredentialDescriptor", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2461"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2462"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2464"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2466"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2468"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u24ea"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2460"}, {"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor\u2460\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptor"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialdescriptor-type'] = {"dfnID": "dom-publickeycredentialdescriptor-type", "url": "#dom-publickeycredentialdescriptor-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-type\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialdescriptor-id'] = {"dfnID": "dom-publickeycredentialdescriptor-id", "url": "#dom-publickeycredentialdescriptor-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2465"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2466"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2467"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialdescriptor-transports'] = {"dfnID": "dom-publickeycredentialdescriptor-transports", "url": "#dom-publickeycredentialdescriptor-transports", "dfnText": "transports", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2464"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2466"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2462"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}], "external": false};
@@ -11382,14 +11518,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['publickey-credentials-get-feature'] = {"dfnID": "publickey-credentials-get-feature", "url": "#publickey-credentials-get-feature", "dfnText": "publickey-credentials-get", "refSections": [{"refs": [{"id": "ref-for-publickey-credentials-get-feature"}], "title": "5.10. Using Web Authentication within iframe elements"}], "external": false};
 window.dfnpanelData['authenticator-model'] = {"dfnID": "authenticator-model", "url": "#authenticator-model", "dfnText": "Authenticator Model", "refSections": [{"refs": [{"id": "ref-for-authenticator-model"}, {"id": "ref-for-authenticator-model\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator-model\u2461"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-authenticator-model\u2462"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-authenticator-model\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}], "external": false};
 window.dfnpanelData['authenticator-credentials-map'] = {"dfnID": "authenticator-credentials-map", "url": "#authenticator-credentials-map", "dfnText": "credentials map", "refSections": [{"refs": [{"id": "ref-for-authenticator-credentials-map"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator-credentials-map\u2460"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-authenticator-credentials-map\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator-credentials-map\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator-credentials-map\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
+window.dfnpanelData['aaguid'] = {"dfnID": "aaguid", "url": "#aaguid", "dfnText": "AAGUID", "refSections": [{"refs": [{"id": "ref-for-aaguid"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-aaguid\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-aaguid\u2461"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-aaguid\u2462"}, {"id": "ref-for-aaguid\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-aaguid\u2464"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-aaguid\u2465"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": false};
 window.dfnpanelData['attestation-signature'] = {"dfnID": "attestation-signature", "url": "#attestation-signature", "dfnText": "attestation signature", "refSections": [{"refs": [{"id": "ref-for-attestation-signature"}, {"id": "ref-for-attestation-signature\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-signature\u2461"}, {"id": "ref-for-attestation-signature\u2462"}, {"id": "ref-for-attestation-signature\u2463"}, {"id": "ref-for-attestation-signature\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-attestation-signature\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-attestation-signature\u2466"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-signature\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-signature\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2460"}, {"id": "ref-for-attestation-signature\u2460\u2461"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2462"}, {"id": "ref-for-attestation-signature\u2460\u2463"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2465"}, {"id": "ref-for-attestation-signature\u2460\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2467"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-signature\u2460\u2468"}, {"id": "ref-for-attestation-signature\u2461\u24ea"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
 window.dfnpanelData['assertion-signature'] = {"dfnID": "assertion-signature", "url": "#assertion-signature", "dfnText": "assertion signature", "refSections": [{"refs": [{"id": "ref-for-assertion-signature"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-assertion-signature\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-assertion-signature\u2461"}, {"id": "ref-for-assertion-signature\u2462"}, {"id": "ref-for-assertion-signature\u2463"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-assertion-signature\u2464"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-assertion-signature\u2465"}, {"id": "ref-for-assertion-signature\u2466"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-assertion-signature\u2467"}, {"id": "ref-for-assertion-signature\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-assertion-signature\u2460\u24ea"}, {"id": "ref-for-assertion-signature\u2460\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-assertion-signature\u2460\u2461"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-assertion-signature\u2460\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
 window.dfnpanelData['webauthn-signature'] = {"dfnID": "webauthn-signature", "url": "#webauthn-signature", "dfnText": "WebAuthn signature", "refSections": [{"refs": [{"id": "ref-for-webauthn-signature"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-webauthn-signature\u2460"}], "title": "6. WebAuthn Authenticator Model"}], "external": false};
 window.dfnpanelData['authenticator-data'] = {"dfnID": "authenticator-data", "url": "#authenticator-data", "dfnText": "authenticator data", "refSections": [{"refs": [{"id": "ref-for-authenticator-data"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-authenticator-data\u2460"}, {"id": "ref-for-authenticator-data\u2461"}, {"id": "ref-for-authenticator-data\u2462"}, {"id": "ref-for-authenticator-data\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator-data\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-data\u2465"}, {"id": "ref-for-authenticator-data\u2466"}, {"id": "ref-for-authenticator-data\u2467"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-authenticator-data\u2468"}, {"id": "ref-for-authenticator-data\u2460\u24ea"}, {"id": "ref-for-authenticator-data\u2460\u2460"}, {"id": "ref-for-authenticator-data\u2460\u2461"}, {"id": "ref-for-authenticator-data\u2460\u2462"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authenticator-data\u2460\u2463"}, {"id": "ref-for-authenticator-data\u2460\u2464"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authenticator-data\u2460\u2465"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-authenticator-data\u2460\u2466"}, {"id": "ref-for-authenticator-data\u2460\u2467"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-authenticator-data\u2460\u2468"}, {"id": "ref-for-authenticator-data\u2461\u24ea"}, {"id": "ref-for-authenticator-data\u2461\u2460"}, {"id": "ref-for-authenticator-data\u2461\u2461"}, {"id": "ref-for-authenticator-data\u2461\u2462"}, {"id": "ref-for-authenticator-data\u2461\u2463"}, {"id": "ref-for-authenticator-data\u2461\u2464"}, {"id": "ref-for-authenticator-data\u2461\u2465"}, {"id": "ref-for-authenticator-data\u2461\u2466"}, {"id": "ref-for-authenticator-data\u2461\u2467"}, {"id": "ref-for-authenticator-data\u2461\u2468"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authenticator-data\u2462\u24ea"}, {"id": "ref-for-authenticator-data\u2462\u2460"}, {"id": "ref-for-authenticator-data\u2462\u2461"}, {"id": "ref-for-authenticator-data\u2462\u2462"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-authenticator-data\u2462\u2463"}, {"id": "ref-for-authenticator-data\u2462\u2464"}, {"id": "ref-for-authenticator-data\u2462\u2465"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-authenticator-data\u2462\u2466"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authenticator-data\u2462\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator-data\u2462\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u24ea"}, {"id": "ref-for-authenticator-data\u2463\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u2461"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u2462"}, {"id": "ref-for-authenticator-data\u2463\u2463"}, {"id": "ref-for-authenticator-data\u2463\u2464"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u2465"}, {"id": "ref-for-authenticator-data\u2463\u2466"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u2467"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-authenticator-data\u2463\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u24ea"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2460"}, {"id": "ref-for-authenticator-data\u2464\u2461"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2462"}, {"id": "ref-for-authenticator-data\u2464\u2463"}, {"id": "ref-for-authenticator-data\u2464\u2464"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2465"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2467"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-authenticator-data\u2464\u2468"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-authenticator-data\u2465\u24ea"}], "title": "13.3.1. Attestation Certificate Hierarchy"}], "external": false};
 window.dfnpanelData['authdata-rpidhash'] = {"dfnID": "authdata-rpidhash", "url": "#authdata-rpidhash", "dfnText": "rpIdHash", "refSections": [{"refs": [{"id": "ref-for-authdata-rpidhash"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-rpidhash\u2460"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-authdata-rpidhash\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-rpidhash\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-rpidhash\u2463"}, {"id": "ref-for-authdata-rpidhash\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
-window.dfnpanelData['authdata-flags'] = {"dfnID": "authdata-flags", "url": "#authdata-flags", "dfnText": "flags", "refSections": [{"refs": [{"id": "ref-for-authdata-flags"}, {"id": "ref-for-authdata-flags\u2460"}, {"id": "ref-for-authdata-flags\u2461"}, {"id": "ref-for-authdata-flags\u2462"}, {"id": "ref-for-authdata-flags\u2463"}, {"id": "ref-for-authdata-flags\u2464"}, {"id": "ref-for-authdata-flags\u2465"}, {"id": "ref-for-authdata-flags\u2466"}, {"id": "ref-for-authdata-flags\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags\u2468"}, {"id": "ref-for-authdata-flags\u2460\u24ea"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-authdata-flags\u2460\u2460"}, {"id": "ref-for-authdata-flags\u2460\u2461"}, {"id": "ref-for-authdata-flags\u2460\u2462"}, {"id": "ref-for-authdata-flags\u2460\u2463"}, {"id": "ref-for-authdata-flags\u2460\u2464"}, {"id": "ref-for-authdata-flags\u2460\u2465"}, {"id": "ref-for-authdata-flags\u2460\u2466"}, {"id": "ref-for-authdata-flags\u2460\u2467"}, {"id": "ref-for-authdata-flags\u2460\u2468"}, {"id": "ref-for-authdata-flags\u2461\u24ea"}, {"id": "ref-for-authdata-flags\u2461\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-flags\u2461\u2461"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-authdata-flags\u2461\u2462"}, {"id": "ref-for-authdata-flags\u2461\u2463"}, {"id": "ref-for-authdata-flags\u2461\u2464"}, {"id": "ref-for-authdata-flags\u2461\u2465"}, {"id": "ref-for-authdata-flags\u2461\u2466"}, {"id": "ref-for-authdata-flags\u2461\u2467"}, {"id": "ref-for-authdata-flags\u2461\u2468"}, {"id": "ref-for-authdata-flags\u2462\u24ea"}, {"id": "ref-for-authdata-flags\u2462\u2460"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authdata-flags\u2462\u2461"}, {"id": "ref-for-authdata-flags\u2462\u2462"}, {"id": "ref-for-authdata-flags\u2462\u2463"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authdata-flags\u2462\u2464"}, {"id": "ref-for-authdata-flags\u2462\u2465"}, {"id": "ref-for-authdata-flags\u2462\u2466"}, {"id": "ref-for-authdata-flags\u2462\u2467"}, {"id": "ref-for-authdata-flags\u2462\u2468"}, {"id": "ref-for-authdata-flags\u2463\u24ea"}, {"id": "ref-for-authdata-flags\u2463\u2460"}, {"id": "ref-for-authdata-flags\u2463\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags\u2463\u2462"}, {"id": "ref-for-authdata-flags\u2463\u2463"}, {"id": "ref-for-authdata-flags\u2463\u2464"}, {"id": "ref-for-authdata-flags\u2463\u2465"}, {"id": "ref-for-authdata-flags\u2463\u2466"}, {"id": "ref-for-authdata-flags\u2463\u2467"}, {"id": "ref-for-authdata-flags\u2463\u2468"}, {"id": "ref-for-authdata-flags\u2464\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-flags\u2464\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authdata-flags\u2464\u2461"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
+window.dfnpanelData['authdata-flags'] = {"dfnID": "authdata-flags", "url": "#authdata-flags", "dfnText": "flags", "refSections": [{"refs": [{"id": "ref-for-authdata-flags"}, {"id": "ref-for-authdata-flags\u2460"}, {"id": "ref-for-authdata-flags\u2461"}, {"id": "ref-for-authdata-flags\u2462"}, {"id": "ref-for-authdata-flags\u2463"}, {"id": "ref-for-authdata-flags\u2464"}, {"id": "ref-for-authdata-flags\u2465"}, {"id": "ref-for-authdata-flags\u2466"}, {"id": "ref-for-authdata-flags\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags\u2468"}, {"id": "ref-for-authdata-flags\u2460\u24ea"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-authdata-flags\u2460\u2460"}, {"id": "ref-for-authdata-flags\u2460\u2461"}, {"id": "ref-for-authdata-flags\u2460\u2462"}, {"id": "ref-for-authdata-flags\u2460\u2463"}, {"id": "ref-for-authdata-flags\u2460\u2464"}, {"id": "ref-for-authdata-flags\u2460\u2465"}, {"id": "ref-for-authdata-flags\u2460\u2466"}, {"id": "ref-for-authdata-flags\u2460\u2467"}, {"id": "ref-for-authdata-flags\u2460\u2468"}, {"id": "ref-for-authdata-flags\u2461\u24ea"}, {"id": "ref-for-authdata-flags\u2461\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-flags\u2461\u2461"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-authdata-flags\u2461\u2462"}, {"id": "ref-for-authdata-flags\u2461\u2463"}, {"id": "ref-for-authdata-flags\u2461\u2464"}, {"id": "ref-for-authdata-flags\u2461\u2465"}, {"id": "ref-for-authdata-flags\u2461\u2466"}, {"id": "ref-for-authdata-flags\u2461\u2467"}, {"id": "ref-for-authdata-flags\u2461\u2468"}, {"id": "ref-for-authdata-flags\u2462\u24ea"}, {"id": "ref-for-authdata-flags\u2462\u2460"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authdata-flags\u2462\u2461"}, {"id": "ref-for-authdata-flags\u2462\u2462"}, {"id": "ref-for-authdata-flags\u2462\u2463"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authdata-flags\u2462\u2464"}, {"id": "ref-for-authdata-flags\u2462\u2465"}, {"id": "ref-for-authdata-flags\u2462\u2466"}, {"id": "ref-for-authdata-flags\u2462\u2467"}, {"id": "ref-for-authdata-flags\u2462\u2468"}, {"id": "ref-for-authdata-flags\u2463\u24ea"}, {"id": "ref-for-authdata-flags\u2463\u2460"}, {"id": "ref-for-authdata-flags\u2463\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags\u2463\u2462"}, {"id": "ref-for-authdata-flags\u2463\u2463"}, {"id": "ref-for-authdata-flags\u2463\u2464"}, {"id": "ref-for-authdata-flags\u2463\u2465"}, {"id": "ref-for-authdata-flags\u2463\u2466"}, {"id": "ref-for-authdata-flags\u2463\u2467"}, {"id": "ref-for-authdata-flags\u2463\u2468"}, {"id": "ref-for-authdata-flags\u2464\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-flags\u2464\u2460"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
 window.dfnpanelData['authdata-flags-up'] = {"dfnID": "authdata-flags-up", "url": "#authdata-flags-up", "dfnText": "UP", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-up"}, {"id": "ref-for-authdata-flags-up\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-flags-up\u2461"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}, {"refs": [{"id": "ref-for-authdata-flags-up\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags-up\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
-window.dfnpanelData['authdata-flags-uv'] = {"dfnID": "authdata-flags-uv", "url": "#authdata-flags-uv", "dfnText": "UV", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-uv"}, {"id": "ref-for-authdata-flags-uv\u2460"}, {"id": "ref-for-authdata-flags-uv\u2461"}, {"id": "ref-for-authdata-flags-uv\u2462"}, {"id": "ref-for-authdata-flags-uv\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2464"}, {"id": "ref-for-authdata-flags-uv\u2465"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2466"}, {"id": "ref-for-authdata-flags-uv\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2468"}, {"id": "ref-for-authdata-flags-uv\u2460\u24ea"}, {"id": "ref-for-authdata-flags-uv\u2460\u2460"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2461"}, {"id": "ref-for-authdata-flags-uv\u2460\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2463"}, {"id": "ref-for-authdata-flags-uv\u2460\u2464"}, {"id": "ref-for-authdata-flags-uv\u2460\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2466"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
+window.dfnpanelData['authdata-flags-uv'] = {"dfnID": "authdata-flags-uv", "url": "#authdata-flags-uv", "dfnText": "UV", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-uv"}, {"id": "ref-for-authdata-flags-uv\u2460"}, {"id": "ref-for-authdata-flags-uv\u2461"}, {"id": "ref-for-authdata-flags-uv\u2462"}, {"id": "ref-for-authdata-flags-uv\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2464"}, {"id": "ref-for-authdata-flags-uv\u2465"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2466"}, {"id": "ref-for-authdata-flags-uv\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2468"}, {"id": "ref-for-authdata-flags-uv\u2460\u24ea"}, {"id": "ref-for-authdata-flags-uv\u2460\u2460"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2461"}, {"id": "ref-for-authdata-flags-uv\u2460\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2463"}, {"id": "ref-for-authdata-flags-uv\u2460\u2464"}, {"id": "ref-for-authdata-flags-uv\u2460\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-flags-uv\u2460\u2466"}], "title": "14.3. Authenticator-local Biometric Recognition"}], "external": false};
 window.dfnpanelData['authdata-flags-be'] = {"dfnID": "authdata-flags-be", "url": "#authdata-flags-be", "dfnText": "BE", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-be"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags-be\u2460"}, {"id": "ref-for-authdata-flags-be\u2461"}, {"id": "ref-for-authdata-flags-be\u2462"}, {"id": "ref-for-authdata-flags-be\u2463"}, {"id": "ref-for-authdata-flags-be\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authdata-flags-be\u2465"}, {"id": "ref-for-authdata-flags-be\u2466"}, {"id": "ref-for-authdata-flags-be\u2467"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags-be\u2468"}, {"id": "ref-for-authdata-flags-be\u2460\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['authdata-flags-bs'] = {"dfnID": "authdata-flags-bs", "url": "#authdata-flags-bs", "dfnText": "BS", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-bs"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-flags-bs\u2460"}, {"id": "ref-for-authdata-flags-bs\u2461"}, {"id": "ref-for-authdata-flags-bs\u2462"}, {"id": "ref-for-authdata-flags-bs\u2463"}, {"id": "ref-for-authdata-flags-bs\u2464"}, {"id": "ref-for-authdata-flags-bs\u2465"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-authdata-flags-bs\u2466"}, {"id": "ref-for-authdata-flags-bs\u2467"}, {"id": "ref-for-authdata-flags-bs\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-flags-bs\u2460\u24ea"}, {"id": "ref-for-authdata-flags-bs\u2460\u2460"}, {"id": "ref-for-authdata-flags-bs\u2460\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['authdata-flags-at'] = {"dfnID": "authdata-flags-at", "url": "#authdata-flags-at", "dfnText": "AT", "refSections": [{"refs": [{"id": "ref-for-authdata-flags-at"}, {"id": "ref-for-authdata-flags-at\u2460"}, {"id": "ref-for-authdata-flags-at\u2461"}, {"id": "ref-for-authdata-flags-at\u2462"}, {"id": "ref-for-authdata-flags-at\u2463"}], "title": "6.1. Authenticator Data"}], "external": false};
@@ -11430,19 +11567,19 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['discoverablecredentialmetadata-type'] = {"dfnID": "discoverablecredentialmetadata-type", "url": "#discoverablecredentialmetadata-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-discoverablecredentialmetadata-type"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
 window.dfnpanelData['discoverablecredentialmetadata-id'] = {"dfnID": "discoverablecredentialmetadata-id", "url": "#discoverablecredentialmetadata-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-discoverablecredentialmetadata-id"}, {"id": "ref-for-discoverablecredentialmetadata-id\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
 window.dfnpanelData['discoverablecredentialmetadata-otherui'] = {"dfnID": "discoverablecredentialmetadata-otherui", "url": "#discoverablecredentialmetadata-otherui", "dfnText": "otherUI", "refSections": [{"refs": [{"id": "ref-for-discoverablecredentialmetadata-otherui"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": false};
-window.dfnpanelData['attestation-object'] = {"dfnID": "attestation-object", "url": "#attestation-object", "dfnText": "attestation object", "refSections": [{"refs": [{"id": "ref-for-attestation-object"}, {"id": "ref-for-attestation-object\u2460"}, {"id": "ref-for-attestation-object\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-object\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-attestation-object\u2463"}, {"id": "ref-for-attestation-object\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-object\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-attestation-object\u2466"}, {"id": "ref-for-attestation-object\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-attestation-object\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u24ea"}, {"id": "ref-for-attestation-object\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2461"}, {"id": "ref-for-attestation-object\u2460\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2463"}, {"id": "ref-for-attestation-object\u2460\u2464"}, {"id": "ref-for-attestation-object\u2460\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2466"}, {"id": "ref-for-attestation-object\u2460\u2467"}, {"id": "ref-for-attestation-object\u2460\u2468"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u24ea"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2460"}, {"id": "ref-for-attestation-object\u2461\u2461"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2463"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2464"}, {"id": "ref-for-attestation-object\u2461\u2465"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
-window.dfnpanelData['attestation-statement'] = {"dfnID": "attestation-statement", "url": "#attestation-statement", "dfnText": "attestation statement", "refSections": [{"refs": [{"id": "ref-for-attestation-statement"}, {"id": "ref-for-attestation-statement\u2460"}, {"id": "ref-for-attestation-statement\u2461"}, {"id": "ref-for-attestation-statement\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-statement\u2463"}, {"id": "ref-for-attestation-statement\u2464"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation-statement\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation-statement\u2466"}, {"id": "ref-for-attestation-statement\u2467"}, {"id": "ref-for-attestation-statement\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-statement\u2460\u24ea"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-attestation-statement\u2460\u2460"}, {"id": "ref-for-attestation-statement\u2460\u2461"}, {"id": "ref-for-attestation-statement\u2460\u2462"}, {"id": "ref-for-attestation-statement\u2460\u2463"}, {"id": "ref-for-attestation-statement\u2460\u2464"}, {"id": "ref-for-attestation-statement\u2460\u2465"}, {"id": "ref-for-attestation-statement\u2460\u2466"}, {"id": "ref-for-attestation-statement\u2460\u2467"}, {"id": "ref-for-attestation-statement\u2460\u2468"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u24ea"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u2460"}, {"id": "ref-for-attestation-statement\u2461\u2461"}, {"id": "ref-for-attestation-statement\u2461\u2462"}, {"id": "ref-for-attestation-statement\u2461\u2463"}, {"id": "ref-for-attestation-statement\u2461\u2464"}, {"id": "ref-for-attestation-statement\u2461\u2465"}, {"id": "ref-for-attestation-statement\u2461\u2466"}, {"id": "ref-for-attestation-statement\u2461\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u2468"}, {"id": "ref-for-attestation-statement\u2462\u24ea"}, {"id": "ref-for-attestation-statement\u2462\u2460"}, {"id": "ref-for-attestation-statement\u2462\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement\u2462\u2462"}, {"id": "ref-for-attestation-statement\u2462\u2463"}, {"id": "ref-for-attestation-statement\u2462\u2464"}, {"id": "ref-for-attestation-statement\u2462\u2465"}, {"id": "ref-for-attestation-statement\u2462\u2466"}, {"id": "ref-for-attestation-statement\u2462\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-statement\u2462\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2460"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2461"}, {"id": "ref-for-attestation-statement\u2463\u2462"}, {"id": "ref-for-attestation-statement\u2463\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2464"}, {"id": "ref-for-attestation-statement\u2463\u2465"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2466"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2467"}, {"id": "ref-for-attestation-statement\u2463\u2468"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u24ea"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2460"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2461"}, {"id": "ref-for-attestation-statement\u2464\u2462"}, {"id": "ref-for-attestation-statement\u2464\u2463"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
-window.dfnpanelData['attestation-statement-format'] = {"dfnID": "attestation-statement-format", "url": "#attestation-statement-format", "dfnText": "attestation statement format", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461"}, {"id": "ref-for-attestation-statement-format\u2462"}, {"id": "ref-for-attestation-statement-format\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2464"}, {"id": "ref-for-attestation-statement-format\u2465"}, {"id": "ref-for-attestation-statement-format\u2466"}, {"id": "ref-for-attestation-statement-format\u2467"}, {"id": "ref-for-attestation-statement-format\u2468"}, {"id": "ref-for-attestation-statement-format\u2460\u24ea"}, {"id": "ref-for-attestation-statement-format\u2460\u2460"}, {"id": "ref-for-attestation-statement-format\u2460\u2461"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2462"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2463"}, {"id": "ref-for-attestation-statement-format\u2460\u2464"}, {"id": "ref-for-attestation-statement-format\u2460\u2465"}, {"id": "ref-for-attestation-statement-format\u2460\u2466"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2467"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2468"}, {"id": "ref-for-attestation-statement-format\u2461\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2460"}, {"id": "ref-for-attestation-statement-format\u2461\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2462"}], "title": "8.1. Attestation Statement Format Identifiers"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2463"}, {"id": "ref-for-attestation-statement-format\u2461\u2464"}, {"id": "ref-for-attestation-statement-format\u2461\u2465"}, {"id": "ref-for-attestation-statement-format\u2461\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2467"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2462\u24ea"}, {"id": "ref-for-attestation-statement-format\u2462\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['attestation-object'] = {"dfnID": "attestation-object", "url": "#attestation-object", "dfnText": "attestation object", "refSections": [{"refs": [{"id": "ref-for-attestation-object"}, {"id": "ref-for-attestation-object\u2460"}, {"id": "ref-for-attestation-object\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-object\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-attestation-object\u2463"}, {"id": "ref-for-attestation-object\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-object\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-attestation-object\u2466"}, {"id": "ref-for-attestation-object\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-attestation-object\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u24ea"}, {"id": "ref-for-attestation-object\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2461"}, {"id": "ref-for-attestation-object\u2460\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2463"}, {"id": "ref-for-attestation-object\u2460\u2464"}, {"id": "ref-for-attestation-object\u2460\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-object\u2460\u2466"}, {"id": "ref-for-attestation-object\u2460\u2467"}, {"id": "ref-for-attestation-object\u2460\u2468"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u24ea"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2460"}, {"id": "ref-for-attestation-object\u2461\u2461"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2463"}], "title": "8.2.1. Packed Attestation Statement Certificate Requirements"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2464"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-object\u2461\u2465"}, {"id": "ref-for-attestation-object\u2461\u2466"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
+window.dfnpanelData['attestation-statement'] = {"dfnID": "attestation-statement", "url": "#attestation-statement", "dfnText": "attestation statement", "refSections": [{"refs": [{"id": "ref-for-attestation-statement"}, {"id": "ref-for-attestation-statement\u2460"}, {"id": "ref-for-attestation-statement\u2461"}, {"id": "ref-for-attestation-statement\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation-statement\u2463"}, {"id": "ref-for-attestation-statement\u2464"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation-statement\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation-statement\u2466"}, {"id": "ref-for-attestation-statement\u2467"}, {"id": "ref-for-attestation-statement\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-statement\u2460\u24ea"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-attestation-statement\u2460\u2460"}, {"id": "ref-for-attestation-statement\u2460\u2461"}, {"id": "ref-for-attestation-statement\u2460\u2462"}, {"id": "ref-for-attestation-statement\u2460\u2463"}, {"id": "ref-for-attestation-statement\u2460\u2464"}, {"id": "ref-for-attestation-statement\u2460\u2465"}, {"id": "ref-for-attestation-statement\u2460\u2466"}, {"id": "ref-for-attestation-statement\u2460\u2467"}, {"id": "ref-for-attestation-statement\u2460\u2468"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u24ea"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u2460"}, {"id": "ref-for-attestation-statement\u2461\u2461"}, {"id": "ref-for-attestation-statement\u2461\u2462"}, {"id": "ref-for-attestation-statement\u2461\u2463"}, {"id": "ref-for-attestation-statement\u2461\u2464"}, {"id": "ref-for-attestation-statement\u2461\u2465"}, {"id": "ref-for-attestation-statement\u2461\u2466"}, {"id": "ref-for-attestation-statement\u2461\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-statement\u2461\u2468"}, {"id": "ref-for-attestation-statement\u2462\u24ea"}, {"id": "ref-for-attestation-statement\u2462\u2460"}, {"id": "ref-for-attestation-statement\u2462\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement\u2462\u2462"}, {"id": "ref-for-attestation-statement\u2462\u2463"}, {"id": "ref-for-attestation-statement\u2462\u2464"}, {"id": "ref-for-attestation-statement\u2462\u2465"}, {"id": "ref-for-attestation-statement\u2462\u2466"}, {"id": "ref-for-attestation-statement\u2462\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-statement\u2462\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u24ea"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2460"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2461"}, {"id": "ref-for-attestation-statement\u2463\u2462"}, {"id": "ref-for-attestation-statement\u2463\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2464"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2465"}, {"id": "ref-for-attestation-statement\u2463\u2466"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2467"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-statement\u2463\u2468"}, {"id": "ref-for-attestation-statement\u2464\u24ea"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2460"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2461"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2462"}, {"id": "ref-for-attestation-statement\u2464\u2463"}, {"id": "ref-for-attestation-statement\u2464\u2464"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-attestation-statement\u2464\u2465"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
+window.dfnpanelData['attestation-statement-format'] = {"dfnID": "attestation-statement-format", "url": "#attestation-statement-format", "dfnText": "attestation statement format", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461"}, {"id": "ref-for-attestation-statement-format\u2462"}, {"id": "ref-for-attestation-statement-format\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2464"}, {"id": "ref-for-attestation-statement-format\u2465"}, {"id": "ref-for-attestation-statement-format\u2466"}, {"id": "ref-for-attestation-statement-format\u2467"}, {"id": "ref-for-attestation-statement-format\u2468"}, {"id": "ref-for-attestation-statement-format\u2460\u24ea"}, {"id": "ref-for-attestation-statement-format\u2460\u2460"}, {"id": "ref-for-attestation-statement-format\u2460\u2461"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2462"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2463"}, {"id": "ref-for-attestation-statement-format\u2460\u2464"}, {"id": "ref-for-attestation-statement-format\u2460\u2465"}, {"id": "ref-for-attestation-statement-format\u2460\u2466"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2467"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2460\u2468"}, {"id": "ref-for-attestation-statement-format\u2461\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2460"}, {"id": "ref-for-attestation-statement-format\u2461\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2462"}], "title": "8.1. Attestation Statement Format Identifiers"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2463"}, {"id": "ref-for-attestation-statement-format\u2461\u2464"}, {"id": "ref-for-attestation-statement-format\u2461\u2465"}, {"id": "ref-for-attestation-statement-format\u2461\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2467"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2461\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-attestation-statement-format\u2462\u24ea"}, {"id": "ref-for-attestation-statement-format\u2462\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
 window.dfnpanelData['attestation-type'] = {"dfnID": "attestation-type", "url": "#attestation-type", "dfnText": "attestation type", "refSections": [{"refs": [{"id": "ref-for-attestation-type"}, {"id": "ref-for-attestation-type\u2460"}, {"id": "ref-for-attestation-type\u2461"}, {"id": "ref-for-attestation-type\u2462"}, {"id": "ref-for-attestation-type\u2463"}, {"id": "ref-for-attestation-type\u2464"}, {"id": "ref-for-attestation-type\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation-type\u2466"}, {"id": "ref-for-attestation-type\u2467"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-type\u2468"}, {"id": "ref-for-attestation-type\u2460\u24ea"}, {"id": "ref-for-attestation-type\u2460\u2460"}, {"id": "ref-for-attestation-type\u2460\u2461"}, {"id": "ref-for-attestation-type\u2460\u2462"}, {"id": "ref-for-attestation-type\u2460\u2463"}, {"id": "ref-for-attestation-type\u2460\u2464"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-type\u2460\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-type\u2460\u2466"}, {"id": "ref-for-attestation-type\u2460\u2467"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2460\u2468"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2461\u24ea"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2461\u2460"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2461\u2461"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2461\u2462"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-type\u2461\u2463"}, {"id": "ref-for-attestation-type\u2461\u2464"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
 window.dfnpanelData['attested-credential-data'] = {"dfnID": "attested-credential-data", "url": "#attested-credential-data", "dfnText": "Attested credential data", "refSections": [{"refs": [{"id": "ref-for-attested-credential-data"}, {"id": "ref-for-attested-credential-data\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attested-credential-data\u2461"}, {"id": "ref-for-attested-credential-data\u2462"}, {"id": "ref-for-attested-credential-data\u2463"}, {"id": "ref-for-attested-credential-data\u2464"}, {"id": "ref-for-attested-credential-data\u2465"}, {"id": "ref-for-attested-credential-data\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-attested-credential-data\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attested-credential-data\u2468"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attested-credential-data\u2460\u24ea"}, {"id": "ref-for-attested-credential-data\u2460\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attested-credential-data\u2460\u2461"}, {"id": "ref-for-attested-credential-data\u2460\u2462"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-attested-credential-data\u2460\u2463"}, {"id": "ref-for-attested-credential-data\u2460\u2464"}, {"id": "ref-for-attested-credential-data\u2460\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-attested-credential-data\u2460\u2466"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attested-credential-data\u2460\u2467"}], "title": "10.2.2.2.1. AAGUIDs"}], "external": false};
-window.dfnpanelData['authdata-attestedcredentialdata-aaguid'] = {"dfnID": "authdata-attestedcredentialdata-aaguid", "url": "#authdata-attestedcredentialdata-aaguid", "dfnText": "aaguid", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2461"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2462"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2464"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2466"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2467"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2468"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u24ea"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u2460"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u2461"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u2462"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u2463"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460\u2464"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": false};
+window.dfnpanelData['authdata-attestedcredentialdata-aaguid'] = {"dfnID": "authdata-attestedcredentialdata-aaguid", "url": "#authdata-attestedcredentialdata-aaguid", "dfnText": "aaguid", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2460"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2461"}, {"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2465"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2466"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2467"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-aaguid\u2468"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": false};
 window.dfnpanelData['authdata-attestedcredentialdata-credentialidlength'] = {"dfnID": "authdata-attestedcredentialdata-credentialidlength", "url": "#authdata-attestedcredentialdata-credentialidlength", "dfnText": "credentialIdLength", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialidlength"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialidlength\u2460"}], "title": "6.1. Authenticator Data"}], "external": false};
 window.dfnpanelData['authdata-attestedcredentialdata-credentialid'] = {"dfnID": "authdata-attestedcredentialdata-credentialid", "url": "#authdata-attestedcredentialdata-credentialid", "dfnText": "credentialId", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialid"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2460"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2461"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2462"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2463"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2464"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialid\u2466"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['authdata-attestedcredentialdata-credentialpublickey'] = {"dfnID": "authdata-attestedcredentialdata-credentialpublickey", "url": "#authdata-attestedcredentialdata-credentialpublickey", "dfnText": "credentialPublicKey", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}], "title": "6.5.2.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2468"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460\u24ea"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['signing-procedure'] = {"dfnID": "signing-procedure", "url": "#signing-procedure", "dfnText": "Signing procedure", "refSections": [{"refs": [{"id": "ref-for-signing-procedure"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-signing-procedure"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-signing-procedure\u2460"}], "title": "6.5.5. Generating an Attestation Object"}], "external": false};
 window.dfnpanelData['authenticator-data-for-the-attestation'] = {"dfnID": "authenticator-data-for-the-attestation", "url": "#authenticator-data-for-the-attestation", "dfnText": "authenticator data\nfor the attestation", "refSections": [{"refs": [{"id": "ref-for-authenticator-data-for-the-attestation"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2461"}, {"id": "ref-for-authenticator-data-for-the-attestation\u2462"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2463"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
-window.dfnpanelData['verification-procedure'] = {"dfnID": "verification-procedure", "url": "#verification-procedure", "dfnText": "Verification procedure", "refSections": [{"refs": [{"id": "ref-for-verification-procedure"}, {"id": "ref-for-verification-procedure\u2460"}, {"id": "ref-for-verification-procedure\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-verification-procedure\u2462"}, {"id": "ref-for-verification-procedure\u2463"}, {"id": "ref-for-verification-procedure\u2464"}, {"id": "ref-for-verification-procedure\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-verification-procedure\u2466"}, {"id": "ref-for-verification-procedure\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-verification-procedure\u2468"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u24ea"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2461"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2462"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2463"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2464"}, {"id": "ref-for-verification-procedure\u2460\u2465"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['verification-procedure-inputs'] = {"dfnID": "verification-procedure-inputs", "url": "#verification-procedure-inputs", "dfnText": "verification procedure inputs", "refSections": [{"refs": [{"id": "ref-for-verification-procedure-inputs"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2462"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
+window.dfnpanelData['verification-procedure'] = {"dfnID": "verification-procedure", "url": "#verification-procedure", "dfnText": "Verification procedure", "refSections": [{"refs": [{"id": "ref-for-verification-procedure"}, {"id": "ref-for-verification-procedure\u2460"}, {"id": "ref-for-verification-procedure\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-verification-procedure\u2462"}, {"id": "ref-for-verification-procedure\u2463"}, {"id": "ref-for-verification-procedure\u2464"}, {"id": "ref-for-verification-procedure\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-verification-procedure\u2466"}, {"id": "ref-for-verification-procedure\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-verification-procedure\u2468"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u24ea"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2461"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2462"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2463"}, {"id": "ref-for-verification-procedure\u2460\u2464"}, {"id": "ref-for-verification-procedure\u2460\u2465"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2466"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2467"}, {"id": "ref-for-verification-procedure\u2460\u2468"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['verification-procedure-inputs'] = {"dfnID": "verification-procedure-inputs", "url": "#verification-procedure-inputs", "dfnText": "verification procedure inputs", "refSections": [{"refs": [{"id": "ref-for-verification-procedure-inputs"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2462"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2464"}, {"id": "ref-for-verification-procedure-inputs\u2465"}], "title": "8.9. Compound Attestation Statement Format"}], "external": false};
 window.dfnpanelData['authenticator-data-claimed-to-have-been-used-for-the-attestation'] = {"dfnID": "authenticator-data-claimed-to-have-been-used-for-the-attestation", "url": "#authenticator-data-claimed-to-have-been-used-for-the-attestation", "dfnText": "authenticator data claimed to have been used for the attestation", "refSections": [{"refs": [{"id": "ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation"}], "title": "8.4. Android Key Attestation Statement Format"}], "external": false};
 window.dfnpanelData['attestation-trust-path'] = {"dfnID": "attestation-trust-path", "url": "#attestation-trust-path", "dfnText": "attestation trust path", "refSections": [{"refs": [{"id": "ref-for-attestation-trust-path"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2460"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2462"}, {"id": "ref-for-attestation-trust-path\u2463"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2464"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2465"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2466"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2467"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2468"}], "title": "8.7. None Attestation Statement Format"}], "external": false};
 window.dfnpanelData['basic-attestation'] = {"dfnID": "basic-attestation", "url": "#basic-attestation", "dfnText": "Basic Attestation", "refSections": [{"refs": [{"id": "ref-for-basic-attestation"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-basic-attestation\u2460"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
@@ -11455,13 +11592,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['anonymization-ca'] = {"dfnID": "anonymization-ca", "url": "#anonymization-ca", "dfnText": "Anonymization CA", "refSections": [{"refs": [{"id": "ref-for-anonymization-ca"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-anonymization-ca\u2460"}, {"id": "ref-for-anonymization-ca\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-anonymization-ca\u2462"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-anonymization-ca\u2463"}, {"id": "ref-for-anonymization-ca\u2464"}], "title": "8.8. Apple Anonymous Attestation Statement Format"}, {"refs": [{"id": "ref-for-anonymization-ca\u2465"}, {"id": "ref-for-anonymization-ca\u2466"}, {"id": "ref-for-anonymization-ca\u2467"}, {"id": "ref-for-anonymization-ca\u2468"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['anonca'] = {"dfnID": "anonca", "url": "#anonca", "dfnText": "AnonCA", "refSections": [{"refs": [{"id": "ref-for-anonca"}], "title": "6.5.4. Attestation Types"}], "external": false};
 window.dfnpanelData['none'] = {"dfnID": "none", "url": "#none", "dfnText": "None", "refSections": [{"refs": [{"id": "ref-for-none"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-none\u2460"}, {"id": "ref-for-none\u2461"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-none\u2462"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-none\u2463"}, {"id": "ref-for-none\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-none\u2465"}, {"id": "ref-for-none\u2466"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-none\u2467"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-none\u2468"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
-window.dfnpanelData['attestation-statement-format-identifier'] = {"dfnID": "attestation-statement-format-identifier", "url": "#attestation-statement-format-identifier", "dfnText": "attestation statement format identifier", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format-identifier"}, {"id": "ref-for-attestation-statement-format-identifier\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2462"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2463"}], "title": "8.1. Attestation Statement Format Identifiers"}], "external": false};
+window.dfnpanelData['attestation-statement-format-identifier'] = {"dfnID": "attestation-statement-format-identifier", "url": "#attestation-statement-format-identifier", "dfnText": "attestation statement format identifier", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format-identifier"}, {"id": "ref-for-attestation-statement-format-identifier\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2462"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2463"}], "title": "8.1. Attestation Statement Format Identifiers"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2464"}], "title": "8.9. Compound Attestation Statement Format"}], "external": false};
 window.dfnpanelData['android-key-attestation-certificate-extension-data'] = {"dfnID": "android-key-attestation-certificate-extension-data", "url": "#android-key-attestation-certificate-extension-data", "dfnText": "android key attestation certificate extension\ndata", "refSections": [{"refs": [{"id": "ref-for-android-key-attestation-certificate-extension-data"}, {"id": "ref-for-android-key-attestation-certificate-extension-data\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}], "external": false};
-window.dfnpanelData['webauthn-extensions'] = {"dfnID": "webauthn-extensions", "url": "#webauthn-extensions", "dfnText": "WebAuthn Extensions", "refSections": [{"refs": [{"id": "ref-for-webauthn-extensions"}, {"id": "ref-for-webauthn-extensions\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2463"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2464"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2465"}], "title": "5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2466"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2467"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2468"}, {"id": "ref-for-webauthn-extensions\u2460\u24ea"}, {"id": "ref-for-webauthn-extensions\u2460\u2460"}], "title": "9. WebAuthn Extensions"}], "external": false};
-window.dfnpanelData['registration-extension'] = {"dfnID": "registration-extension", "url": "#registration-extension", "dfnText": "registration\nextension", "refSections": [{"refs": [{"id": "ref-for-registration-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-registration-extension\u2460"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-registration-extension\u2461"}, {"id": "ref-for-registration-extension\u2462"}, {"id": "ref-for-registration-extension\u2463"}, {"id": "ref-for-registration-extension\u2464"}, {"id": "ref-for-registration-extension\u2465"}, {"id": "ref-for-registration-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-registration-extension\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-registration-extension\u2468"}, {"id": "ref-for-registration-extension\u2460\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2460"}, {"id": "ref-for-registration-extension\u2460\u2461"}, {"id": "ref-for-registration-extension\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2463"}, {"id": "ref-for-registration-extension\u2460\u2464"}, {"id": "ref-for-registration-extension\u2460\u2465"}, {"id": "ref-for-registration-extension\u2460\u2466"}, {"id": "ref-for-registration-extension\u2460\u2467"}, {"id": "ref-for-registration-extension\u2460\u2468"}, {"id": "ref-for-registration-extension\u2461\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2461"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2464"}, {"id": "ref-for-registration-extension\u2461\u2465"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
-window.dfnpanelData['authentication-extension'] = {"dfnID": "authentication-extension", "url": "#authentication-extension", "dfnText": "authentication extension", "refSections": [{"refs": [{"id": "ref-for-authentication-extension"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authentication-extension\u2460"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-authentication-extension\u2461"}, {"id": "ref-for-authentication-extension\u2462"}, {"id": "ref-for-authentication-extension\u2463"}, {"id": "ref-for-authentication-extension\u2464"}, {"id": "ref-for-authentication-extension\u2465"}, {"id": "ref-for-authentication-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authentication-extension\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-authentication-extension\u2468"}, {"id": "ref-for-authentication-extension\u2460\u24ea"}, {"id": "ref-for-authentication-extension\u2460\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authentication-extension\u2460\u2461"}, {"id": "ref-for-authentication-extension\u2460\u2462"}, {"id": "ref-for-authentication-extension\u2460\u2463"}, {"id": "ref-for-authentication-extension\u2460\u2464"}, {"id": "ref-for-authentication-extension\u2460\u2465"}, {"id": "ref-for-authentication-extension\u2460\u2466"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-authentication-extension\u2460\u2467"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-authentication-extension\u2460\u2468"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u24ea"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2460"}, {"id": "ref-for-authentication-extension\u2461\u2461"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2462"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
+window.dfnpanelData['webauthn-extensions'] = {"dfnID": "webauthn-extensions", "url": "#webauthn-extensions", "dfnText": "WebAuthn Extensions", "refSections": [{"refs": [{"id": "ref-for-webauthn-extensions"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2462"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2463"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2464"}], "title": "5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2465"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2466"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2467"}, {"id": "ref-for-webauthn-extensions\u2468"}, {"id": "ref-for-webauthn-extensions\u2460\u24ea"}], "title": "9. WebAuthn Extensions"}], "external": false};
+window.dfnpanelData['registration-extension'] = {"dfnID": "registration-extension", "url": "#registration-extension", "dfnText": "registration\nextension", "refSections": [{"refs": [{"id": "ref-for-registration-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-registration-extension\u2460"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-registration-extension\u2461"}, {"id": "ref-for-registration-extension\u2462"}, {"id": "ref-for-registration-extension\u2463"}, {"id": "ref-for-registration-extension\u2464"}, {"id": "ref-for-registration-extension\u2465"}, {"id": "ref-for-registration-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-registration-extension\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-registration-extension\u2468"}, {"id": "ref-for-registration-extension\u2460\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2460"}, {"id": "ref-for-registration-extension\u2460\u2461"}, {"id": "ref-for-registration-extension\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2463"}, {"id": "ref-for-registration-extension\u2460\u2464"}, {"id": "ref-for-registration-extension\u2460\u2465"}, {"id": "ref-for-registration-extension\u2460\u2466"}, {"id": "ref-for-registration-extension\u2460\u2467"}, {"id": "ref-for-registration-extension\u2460\u2468"}, {"id": "ref-for-registration-extension\u2461\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2461"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2464"}, {"id": "ref-for-registration-extension\u2461\u2465"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
+window.dfnpanelData['authentication-extension'] = {"dfnID": "authentication-extension", "url": "#authentication-extension", "dfnText": "authentication extension", "refSections": [{"refs": [{"id": "ref-for-authentication-extension"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authentication-extension\u2460"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-authentication-extension\u2461"}, {"id": "ref-for-authentication-extension\u2462"}, {"id": "ref-for-authentication-extension\u2463"}, {"id": "ref-for-authentication-extension\u2464"}, {"id": "ref-for-authentication-extension\u2465"}, {"id": "ref-for-authentication-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authentication-extension\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-authentication-extension\u2468"}, {"id": "ref-for-authentication-extension\u2460\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-authentication-extension\u2460\u2460"}, {"id": "ref-for-authentication-extension\u2460\u2461"}, {"id": "ref-for-authentication-extension\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-authentication-extension\u2460\u2463"}, {"id": "ref-for-authentication-extension\u2460\u2464"}, {"id": "ref-for-authentication-extension\u2460\u2465"}, {"id": "ref-for-authentication-extension\u2460\u2466"}, {"id": "ref-for-authentication-extension\u2460\u2467"}, {"id": "ref-for-authentication-extension\u2460\u2468"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u24ea"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2460"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2461"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2462"}, {"id": "ref-for-authentication-extension\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-authentication-extension\u2461\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
 window.dfnpanelData['client-extension'] = {"dfnID": "client-extension", "url": "#client-extension", "dfnText": "client extension", "refSections": [{"refs": [{"id": "ref-for-client-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2465"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client-extension\u2466"}], "title": "10.1. Client Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-extension\u2468"}, {"id": "ref-for-client-extension\u2460\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2461"}], "title": "10.2. Authenticator Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2462"}, {"id": "ref-for-client-extension\u2460\u2463"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
-window.dfnpanelData['authenticator-extension'] = {"dfnID": "authenticator-extension", "url": "#authenticator-extension", "dfnText": "authenticator extension", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authenticator-extension\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator-extension\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authenticator-extension\u2464"}, {"id": "ref-for-authenticator-extension\u2465"}, {"id": "ref-for-authenticator-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2467"}, {"id": "ref-for-authenticator-extension\u2468"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u24ea"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2460"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2461"}], "title": "10.2. Authenticator Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2462"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2463"}, {"id": "ref-for-authenticator-extension\u2460\u2464"}, {"id": "ref-for-authenticator-extension\u2460\u2465"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2466"}, {"id": "ref-for-authenticator-extension\u2460\u2467"}], "title": "11.2. Virtual Authenticators"}], "external": false};
+window.dfnpanelData['authenticator-extension'] = {"dfnID": "authenticator-extension", "url": "#authenticator-extension", "dfnText": "authenticator extension", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authenticator-extension\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator-extension\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authenticator-extension\u2464"}, {"id": "ref-for-authenticator-extension\u2465"}, {"id": "ref-for-authenticator-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2467"}, {"id": "ref-for-authenticator-extension\u2468"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u24ea"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2460"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2461"}], "title": "10.2. Authenticator Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2462"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2463"}, {"id": "ref-for-authenticator-extension\u2460\u2464"}, {"id": "ref-for-authenticator-extension\u2460\u2465"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2466"}, {"id": "ref-for-authenticator-extension\u2460\u2467"}], "title": "11.2. Virtual Authenticators"}], "external": false};
 window.dfnpanelData['extension-identifier'] = {"dfnID": "extension-identifier", "url": "#extension-identifier", "dfnText": "extension identifier", "refSections": [{"refs": [{"id": "ref-for-extension-identifier"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-extension-identifier\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-extension-identifier\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-extension-identifier\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-extension-identifier\u2463"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-extension-identifier\u2464"}, {"id": "ref-for-extension-identifier\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-extension-identifier\u2466"}, {"id": "ref-for-extension-identifier\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-extension-identifier\u2468"}, {"id": "ref-for-extension-identifier\u2460\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2460"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2461"}, {"id": "ref-for-extension-identifier\u2460\u2462"}, {"id": "ref-for-extension-identifier\u2460\u2463"}, {"id": "ref-for-extension-identifier\u2460\u2464"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2465"}, {"id": "ref-for-extension-identifier\u2460\u2466"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2467"}, {"id": "ref-for-extension-identifier\u2460\u2468"}, {"id": "ref-for-extension-identifier\u2461\u24ea"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2460"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2461"}, {"id": "ref-for-extension-identifier\u2461\u2462"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
 window.dfnpanelData['client-extension-input'] = {"dfnID": "client-extension-input", "url": "#client-extension-input", "dfnText": "client extension input", "refSections": [{"refs": [{"id": "ref-for-client-extension-input"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client-extension-input\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client-extension-input\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2463"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-client-extension-input\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension-input\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension-input\u2466"}, {"id": "ref-for-client-extension-input\u2467"}, {"id": "ref-for-client-extension-input\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u24ea"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2460"}, {"id": "ref-for-client-extension-input\u2460\u2461"}, {"id": "ref-for-client-extension-input\u2460\u2462"}, {"id": "ref-for-client-extension-input\u2460\u2463"}, {"id": "ref-for-client-extension-input\u2460\u2464"}, {"id": "ref-for-client-extension-input\u2460\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2466"}, {"id": "ref-for-client-extension-input\u2460\u2467"}, {"id": "ref-for-client-extension-input\u2460\u2468"}, {"id": "ref-for-client-extension-input\u2461\u24ea"}], "title": "9.4. Client Extension Processing"}], "external": false};
 window.dfnpanelData['authenticator-extension-input'] = {"dfnID": "authenticator-extension-input", "url": "#authenticator-extension-input", "dfnText": "authenticator extension input", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension-input"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460"}, {"id": "ref-for-authenticator-extension-input\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2462"}, {"id": "ref-for-authenticator-extension-input\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2464"}, {"id": "ref-for-authenticator-extension-input\u2465"}, {"id": "ref-for-authenticator-extension-input\u2466"}, {"id": "ref-for-authenticator-extension-input\u2467"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2468"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u24ea"}, {"id": "ref-for-authenticator-extension-input\u2460\u2460"}, {"id": "ref-for-authenticator-extension-input\u2460\u2461"}, {"id": "ref-for-authenticator-extension-input\u2460\u2462"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u2463"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u2464"}, {"id": "ref-for-authenticator-extension-input\u2460\u2465"}, {"id": "ref-for-authenticator-extension-input\u2460\u2466"}], "title": "9.5. Authenticator Extension Processing"}], "external": false};
@@ -11473,12 +11610,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['appid'] = {"dfnID": "appid", "url": "#appid", "dfnText": "AppID", "refSections": [{"refs": [{"id": "ref-for-appid"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-appid\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['dom-authenticationextensionsclientinputs-appid'] = {"dfnID": "dom-authenticationextensionsclientinputs-appid", "url": "#dom-authenticationextensionsclientinputs-appid", "dfnText": "appid", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientinputs-appid"}, {"id": "ref-for-dom-authenticationextensionsclientinputs-appid\u2460"}, {"id": "ref-for-dom-authenticationextensionsclientinputs-appid\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
 window.dfnpanelData['dom-authenticationextensionsclientinputs-appidexclude'] = {"dfnID": "dom-authenticationextensionsclientinputs-appidexclude", "url": "#dom-authenticationextensionsclientinputs-appidexclude", "dfnText": "appidExclude", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientinputs-appidexclude"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": false};
-window.dfnpanelData['credprops'] = {"dfnID": "credprops", "url": "#credprops", "dfnText": "credProps", "refSections": [{"refs": [{"id": "ref-for-credprops"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-credprops\u2460"}, {"id": "ref-for-credprops\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
+window.dfnpanelData['credprops'] = {"dfnID": "credprops", "url": "#credprops", "dfnText": "credProps", "refSections": [{"refs": [{"id": "ref-for-credprops"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-credprops\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-credprops\u2461"}, {"id": "ref-for-credprops\u2462"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
 window.dfnpanelData['dictdef-credentialpropertiesoutput'] = {"dfnID": "dictdef-credentialpropertiesoutput", "url": "#dictdef-credentialpropertiesoutput", "dfnText": "CredentialPropertiesOutput", "refSections": [{"refs": [{"id": "ref-for-dictdef-credentialpropertiesoutput"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsclientoutputs-credprops'] = {"dfnID": "dom-authenticationextensionsclientoutputs-credprops", "url": "#dom-authenticationextensionsclientoutputs-credprops", "dfnText": "credProps", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientoutputs-credprops"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
-window.dfnpanelData['dom-credentialpropertiesoutput-rk'] = {"dfnID": "dom-credentialpropertiesoutput-rk", "url": "#dom-credentialpropertiesoutput-rk", "dfnText": "rk", "refSections": [{"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-rk"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-rk\u2460"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2461"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2462"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2463"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2464"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2465"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
-window.dfnpanelData['credentialpropertiesoutput-resident-key-credential-property'] = {"dfnID": "credentialpropertiesoutput-resident-key-credential-property", "url": "#credentialpropertiesoutput-resident-key-credential-property", "dfnText": "resident key credential property", "refSections": [{"refs": [{"id": "ref-for-credentialpropertiesoutput-resident-key-credential-property"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-credentialpropertiesoutput-resident-key-credential-property\u2460"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
-window.dfnpanelData['credentialpropertiesoutput-client-side-discoverable-credential-property'] = {"dfnID": "credentialpropertiesoutput-client-side-discoverable-credential-property", "url": "#credentialpropertiesoutput-client-side-discoverable-credential-property", "dfnText": "client-side discoverable credential property", "refSections": [{"refs": [{"id": "ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
+window.dfnpanelData['dom-credentialpropertiesoutput-rk'] = {"dfnID": "dom-credentialpropertiesoutput-rk", "url": "#dom-credentialpropertiesoutput-rk", "dfnText": "rk", "refSections": [{"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-rk"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-rk\u2460"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2461"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2462"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2463"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2464"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2465"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2466"}, {"id": "ref-for-dom-credentialpropertiesoutput-rk\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
+window.dfnpanelData['credentialpropertiesoutput-resident-key-credential-property'] = {"dfnID": "credentialpropertiesoutput-resident-key-credential-property", "url": "#credentialpropertiesoutput-resident-key-credential-property", "dfnText": "resident key credential property", "refSections": [{"refs": [{"id": "ref-for-credentialpropertiesoutput-resident-key-credential-property"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
+window.dfnpanelData['dom-credentialpropertiesoutput-authenticatordisplayname'] = {"dfnID": "dom-credentialpropertiesoutput-authenticatordisplayname", "url": "#dom-credentialpropertiesoutput-authenticatordisplayname", "dfnText": "authenticatorDisplayName", "refSections": [{"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-authenticatordisplayname"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2460"}, {"id": "ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2461"}, {"id": "ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2462"}, {"id": "ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}], "external": false};
 window.dfnpanelData['prf'] = {"dfnID": "prf", "url": "#prf", "dfnText": "prf", "refSections": [{"refs": [{"id": "ref-for-prf"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-prf\u2460"}], "title": "11.1.1. Authenticator Extension Capabilities"}], "external": false};
 window.dfnpanelData['dictdef-authenticationextensionsprfvalues'] = {"dfnID": "dictdef-authenticationextensionsprfvalues", "url": "#dictdef-authenticationextensionsprfvalues", "dfnText": "AuthenticationExtensionsPRFValues", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsprfvalues"}, {"id": "ref-for-dictdef-authenticationextensionsprfvalues\u2460"}, {"id": "ref-for-dictdef-authenticationextensionsprfvalues\u2461"}, {"id": "ref-for-dictdef-authenticationextensionsprfvalues\u2462"}, {"id": "ref-for-dictdef-authenticationextensionsprfvalues\u2463"}, {"id": "ref-for-dictdef-authenticationextensionsprfvalues\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
 window.dfnpanelData['dom-authenticationextensionsprfvalues-first'] = {"dfnID": "dom-authenticationextensionsprfvalues-first", "url": "#dom-authenticationextensionsprfvalues-first", "dfnText": "first", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsprfvalues-first"}, {"id": "ref-for-dom-authenticationextensionsprfvalues-first\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
@@ -11506,22 +11642,23 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['user-verification-method'] = {"dfnID": "user-verification-method", "url": "#user-verification-method", "dfnText": "User Verification Method", "refSections": [{"refs": [{"id": "ref-for-user-verification-method"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-user-verification-method\u2460"}, {"id": "ref-for-user-verification-method\u2461"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-user-verification-method\u2462"}], "title": "11.3. Add Virtual Authenticator"}], "external": false};
 window.dfnpanelData['typedefdef-uvmentry'] = {"dfnID": "typedefdef-uvmentry", "url": "#typedefdef-uvmentry", "dfnText": "UvmEntry", "refSections": [{"refs": [{"id": "ref-for-typedefdef-uvmentry"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": false};
 window.dfnpanelData['typedefdef-uvmentries'] = {"dfnID": "typedefdef-uvmentries", "url": "#typedefdef-uvmentries", "dfnText": "UvmEntries", "refSections": [{"refs": [{"id": "ref-for-typedefdef-uvmentries"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-typedefdef-uvmentries\u2460"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-typedefdef-uvmentries\u2461"}], "title": "11.3. Add Virtual Authenticator"}], "external": false};
-window.dfnpanelData['devicepubkey'] = {"dfnID": "devicepubkey", "url": "#devicepubkey", "dfnText": "devicePubKey", "refSections": [{"refs": [{"id": "ref-for-devicepubkey"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-devicepubkey\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-devicepubkey\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-devicepubkey\u2462"}, {"id": "ref-for-devicepubkey\u2463"}, {"id": "ref-for-devicepubkey\u2464"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-devicepubkey\u2465"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-devicepubkey\u2466"}, {"id": "ref-for-devicepubkey\u2467"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": false};
-window.dfnpanelData['dictdef-authenticationextensionsdevicepublickeyinputs'] = {"dfnID": "dictdef-authenticationextensionsdevicepublickeyinputs", "url": "#dictdef-authenticationextensionsdevicepublickeyinputs", "dfnText": "AuthenticationExtensionsDevicePublicKeyInputs", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsdevicepublickeyinputs"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsclientinputs-devicepubkey'] = {"dfnID": "dom-authenticationextensionsclientinputs-devicepubkey", "url": "#dom-authenticationextensionsclientinputs-devicepubkey", "dfnText": "devicePubKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientinputs-devicepubkey"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsdevicepublickeyinputs-attestation'] = {"dfnID": "dom-authenticationextensionsdevicepublickeyinputs-attestation", "url": "#dom-authenticationextensionsdevicepublickeyinputs-attestation", "dfnText": "attestation", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation\u2460"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestation\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsdevicepublickeyinputs-attestationformats'] = {"dfnID": "dom-authenticationextensionsdevicepublickeyinputs-attestationformats", "url": "#dom-authenticationextensionsdevicepublickeyinputs-attestationformats", "dfnText": "attestationFormats", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats\u2460"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dictdef-authenticationextensionsdevicepublickeyoutputs'] = {"dfnID": "dictdef-authenticationextensionsdevicepublickeyoutputs", "url": "#dictdef-authenticationextensionsdevicepublickeyoutputs", "dfnText": "AuthenticationExtensionsDevicePublicKeyOutputs", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsdevicepublickeyoutputs"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsdevicepublickeyoutputs-signature'] = {"dfnID": "dom-authenticationextensionsdevicepublickeyoutputs-signature", "url": "#dom-authenticationextensionsdevicepublickeyoutputs-signature", "dfnText": "signature", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature\u2461"}, {"id": "ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['dom-authenticationextensionsclientoutputs-devicepubkey'] = {"dfnID": "dom-authenticationextensionsclientoutputs-devicepubkey", "url": "#dom-authenticationextensionsclientoutputs-devicepubkey", "dfnText": "devicePubKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientoutputs-devicepubkey"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-authenticationextensionsclientoutputs-devicepubkey\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-credential-record-devicepubkeys'] = {"dfnID": "abstract-opdef-credential-record-devicepubkeys", "url": "#abstract-opdef-credential-record-devicepubkeys", "dfnText": "devicePubKeys", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-devicepubkeys"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-devicepubkeys\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-devicepubkeys\u2461"}, {"id": "ref-for-abstract-opdef-credential-record-devicepubkeys\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['credential-record-device-bound-key-record'] = {"dfnID": "credential-record-device-bound-key-record", "url": "#credential-record-device-bound-key-record", "dfnText": "device-bound key record", "refSections": [{"refs": [{"id": "ref-for-credential-record-device-bound-key-record"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-credential-record-device-bound-key-record\u2460"}, {"id": "ref-for-credential-record-device-bound-key-record\u2461"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-credential-record-device-bound-key-record\u2462"}, {"id": "ref-for-credential-record-device-bound-key-record\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-devicepubkey-record-aaguid'] = {"dfnID": "abstract-opdef-devicepubkey-record-aaguid", "url": "#abstract-opdef-devicepubkey-record-aaguid", "dfnText": "aaguid", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-aaguid"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-aaguid\u2460"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-aaguid\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-devicepubkey-record-dpk'] = {"dfnID": "abstract-opdef-devicepubkey-record-dpk", "url": "#abstract-opdef-devicepubkey-record-dpk", "dfnText": "dpk", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-dpk"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-dpk\u2460"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-dpk\u2461"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-dpk\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-devicepubkey-record-scope'] = {"dfnID": "abstract-opdef-devicepubkey-record-scope", "url": "#abstract-opdef-devicepubkey-record-scope", "dfnText": "scope", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-scope"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-scope\u2460"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-scope\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-devicepubkey-record-fmt'] = {"dfnID": "abstract-opdef-devicepubkey-record-fmt", "url": "#abstract-opdef-devicepubkey-record-fmt", "dfnText": "fmt", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-fmt"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-fmt\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-devicepubkey-record-attstmt'] = {"dfnID": "abstract-opdef-devicepubkey-record-attstmt", "url": "#abstract-opdef-devicepubkey-record-attstmt", "dfnText": "attStmt", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-attstmt"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-devicepubkey-record-attstmt\u2460"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-attstmt\u2461"}, {"id": "ref-for-abstract-opdef-devicepubkey-record-attstmt\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['abstract-opdef-create-a-new-device-bound-key-record'] = {"dfnID": "abstract-opdef-create-a-new-device-bound-key-record", "url": "#abstract-opdef-create-a-new-device-bound-key-record", "dfnText": "Create a new device-bound key record", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-create-a-new-device-bound-key-record"}, {"id": "ref-for-abstract-opdef-create-a-new-device-bound-key-record\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['supplementalpubkeys'] = {"dfnID": "supplementalpubkeys", "url": "#supplementalpubkeys", "dfnText": "supplementalPubKeys", "refSections": [{"refs": [{"id": "ref-for-supplementalpubkeys"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-supplementalpubkeys\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-supplementalpubkeys\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-supplementalpubkeys\u2462"}, {"id": "ref-for-supplementalpubkeys\u2463"}, {"id": "ref-for-supplementalpubkeys\u2464"}], "title": "10.2.2. Supplemental public keys extension (supplementalPubKeys)"}, {"refs": [{"id": "ref-for-supplementalpubkeys\u2465"}], "title": "10.2.2.2.1. AAGUIDs"}, {"refs": [{"id": "ref-for-supplementalpubkeys\u2466"}, {"id": "ref-for-supplementalpubkeys\u2467"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}], "external": false};
+window.dfnpanelData['dictdef-authenticationextensionssupplementalpubkeysinputs'] = {"dfnID": "dictdef-authenticationextensionssupplementalpubkeysinputs", "url": "#dictdef-authenticationextensionssupplementalpubkeysinputs", "dfnText": "AuthenticationExtensionsSupplementalPubKeysInputs", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionssupplementalpubkeysinputs"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionsclientinputs-supplementalpubkeys'] = {"dfnID": "dom-authenticationextensionsclientinputs-supplementalpubkeys", "url": "#dom-authenticationextensionsclientinputs-supplementalpubkeys", "dfnText": "supplementalPubKeys", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientinputs-supplementalpubkeys"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionssupplementalpubkeysinputs-scopes'] = {"dfnID": "dom-authenticationextensionssupplementalpubkeysinputs-scopes", "url": "#dom-authenticationextensionssupplementalpubkeysinputs-scopes", "dfnText": "scopes", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes"}, {"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-scopes\u2460"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionssupplementalpubkeysinputs-attestation'] = {"dfnID": "dom-authenticationextensionssupplementalpubkeysinputs-attestation", "url": "#dom-authenticationextensionssupplementalpubkeysinputs-attestation", "dfnText": "attestation", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation"}, {"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation\u2460"}, {"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestation\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionssupplementalpubkeysinputs-attestationformats'] = {"dfnID": "dom-authenticationextensionssupplementalpubkeysinputs-attestationformats", "url": "#dom-authenticationextensionssupplementalpubkeysinputs-attestationformats", "dfnText": "attestationFormats", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats"}, {"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats\u2460"}, {"id": "ref-for-dom-authenticationextensionssupplementalpubkeysinputs-attestationformats\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dictdef-authenticationextensionssupplementalpubkeysoutputs'] = {"dfnID": "dictdef-authenticationextensionssupplementalpubkeysoutputs", "url": "#dictdef-authenticationextensionssupplementalpubkeysoutputs", "dfnText": "AuthenticationExtensionsSupplementalPubKeysOutputs", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionssupplementalpubkeysoutputs"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionssupplementalpubkeysoutputs-signatures'] = {"dfnID": "dom-authenticationextensionssupplementalpubkeysoutputs-signatures", "url": "#dom-authenticationextensionssupplementalpubkeysoutputs-signatures", "dfnText": "signatures", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-authenticationextensionssupplementalpubkeysoutputs-signatures\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['dom-authenticationextensionsclientoutputs-supplementalpubkeys'] = {"dfnID": "dom-authenticationextensionsclientoutputs-supplementalpubkeys", "url": "#dom-authenticationextensionsclientoutputs-supplementalpubkeys", "dfnText": "supplementalPubKeys", "refSections": [{"refs": [{"id": "ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-authenticationextensionsclientoutputs-supplementalpubkeys\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-credential-record-supplementalpubkeys'] = {"dfnID": "abstract-opdef-credential-record-supplementalpubkeys", "url": "#abstract-opdef-credential-record-supplementalpubkeys", "dfnText": "supplementalPubKeys", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-credential-record-supplementalpubkeys"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2460"}, {"id": "ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2461"}, {"id": "ref-for-abstract-opdef-credential-record-supplementalpubkeys\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['credential-record-supplemental-public-key-record'] = {"dfnID": "credential-record-supplemental-public-key-record", "url": "#credential-record-supplemental-public-key-record", "dfnText": "supplemental public key record", "refSections": [{"refs": [{"id": "ref-for-credential-record-supplemental-public-key-record"}], "title": "10.2.2.3. supplementalPubKeys Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-credential-record-supplemental-public-key-record\u2460"}, {"id": "ref-for-credential-record-supplemental-public-key-record\u2461"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-credential-record-supplemental-public-key-record\u2462"}, {"id": "ref-for-credential-record-supplemental-public-key-record\u2463"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-supplementalpubkeys-record-aaguid'] = {"dfnID": "abstract-opdef-supplementalpubkeys-record-aaguid", "url": "#abstract-opdef-supplementalpubkeys-record-aaguid", "dfnText": "aaguid", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-aaguid"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2460"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-aaguid\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-supplementalpubkeys-record-spk'] = {"dfnID": "abstract-opdef-supplementalpubkeys-record-spk", "url": "#abstract-opdef-supplementalpubkeys-record-spk", "dfnText": "spk", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-spk"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2460"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2461"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-spk\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-supplementalpubkeys-record-scope'] = {"dfnID": "abstract-opdef-supplementalpubkeys-record-scope", "url": "#abstract-opdef-supplementalpubkeys-record-scope", "dfnText": "scope", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-scope"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-scope\u2460"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-scope\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-supplementalpubkeys-record-fmt'] = {"dfnID": "abstract-opdef-supplementalpubkeys-record-fmt", "url": "#abstract-opdef-supplementalpubkeys-record-fmt", "dfnText": "fmt", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-fmt"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-fmt\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-supplementalpubkeys-record-attstmt'] = {"dfnID": "abstract-opdef-supplementalpubkeys-record-attstmt", "url": "#abstract-opdef-supplementalpubkeys-record-attstmt", "dfnText": "attStmt", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-attstmt"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2460"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2461"}, {"id": "ref-for-abstract-opdef-supplementalpubkeys-record-attstmt\u2462"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['abstract-opdef-create-a-new-supplemental-public-key-record'] = {"dfnID": "abstract-opdef-create-a-new-supplemental-public-key-record", "url": "#abstract-opdef-create-a-new-supplemental-public-key-record", "dfnText": "Create a new supplemental public key record", "refSections": [{"refs": [{"id": "ref-for-abstract-opdef-create-a-new-supplemental-public-key-record"}, {"id": "ref-for-abstract-opdef-create-a-new-supplemental-public-key-record\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
 window.dfnpanelData['authenticator-extension-capabilities'] = {"dfnID": "authenticator-extension-capabilities", "url": "#authenticator-extension-capabilities", "dfnText": "Authenticator Extension Capabilities", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension-capabilities"}, {"id": "ref-for-authenticator-extension-capabilities\u2460"}, {"id": "ref-for-authenticator-extension-capabilities\u2461"}], "title": "11.1.1. Authenticator Extension Capabilities"}], "external": false};
 window.dfnpanelData['virtual-authenticators'] = {"dfnID": "virtual-authenticators", "url": "#virtual-authenticators", "dfnText": "Virtual Authenticators", "refSections": [{"refs": [{"id": "ref-for-virtual-authenticators"}, {"id": "ref-for-virtual-authenticators\u2460"}], "title": "11.1. WebAuthn WebDriver Extension Capability"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2461"}, {"id": "ref-for-virtual-authenticators\u2462"}, {"id": "ref-for-virtual-authenticators\u2463"}, {"id": "ref-for-virtual-authenticators\u2464"}, {"id": "ref-for-virtual-authenticators\u2465"}, {"id": "ref-for-virtual-authenticators\u2466"}, {"id": "ref-for-virtual-authenticators\u2467"}, {"id": "ref-for-virtual-authenticators\u2468"}, {"id": "ref-for-virtual-authenticators\u2460\u24ea"}, {"id": "ref-for-virtual-authenticators\u2460\u2460"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2460\u2461"}, {"id": "ref-for-virtual-authenticators\u2460\u2462"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2460\u2463"}, {"id": "ref-for-virtual-authenticators\u2460\u2464"}, {"id": "ref-for-virtual-authenticators\u2460\u2465"}], "title": "11.4. Remove Virtual Authenticator"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2460\u2466"}, {"id": "ref-for-virtual-authenticators\u2460\u2467"}, {"id": "ref-for-virtual-authenticators\u2460\u2468"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2461\u24ea"}, {"id": "ref-for-virtual-authenticators\u2461\u2460"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2461\u2461"}, {"id": "ref-for-virtual-authenticators\u2461\u2462"}, {"id": "ref-for-virtual-authenticators\u2461\u2463"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2461\u2464"}, {"id": "ref-for-virtual-authenticators\u2461\u2465"}, {"id": "ref-for-virtual-authenticators\u2461\u2466"}], "title": "11.8. Remove All Credentials"}, {"refs": [{"id": "ref-for-virtual-authenticators\u2461\u2467"}, {"id": "ref-for-virtual-authenticators\u2461\u2468"}, {"id": "ref-for-virtual-authenticators\u2462\u24ea"}], "title": "11.9. Set User Verified"}], "external": false};
 window.dfnpanelData['virtual-authenticator-database'] = {"dfnID": "virtual-authenticator-database", "url": "#virtual-authenticator-database", "dfnText": "Virtual Authenticator Database", "refSections": [{"refs": [{"id": "ref-for-virtual-authenticator-database"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2460"}, {"id": "ref-for-virtual-authenticator-database\u2461"}], "title": "11.4. Remove Virtual Authenticator"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2462"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2463"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2464"}], "title": "11.7. Remove Credential"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2465"}], "title": "11.8. Remove All Credentials"}, {"refs": [{"id": "ref-for-virtual-authenticator-database\u2466"}], "title": "11.9. Set User Verified"}], "external": false};
@@ -11536,6 +11673,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['remove-all-credentials'] = {"dfnID": "remove-all-credentials", "url": "#remove-all-credentials", "dfnText": "Remove All Credentials", "refSections": [{"refs": [{"id": "ref-for-remove-all-credentials"}], "title": "11.8. Remove All Credentials"}], "external": false};
 window.dfnpanelData['set-user-verified'] = {"dfnID": "set-user-verified", "url": "#set-user-verified", "dfnText": "Set User Verified", "refSections": [{"refs": [{"id": "ref-for-set-user-verified"}], "title": "11.9. Set User Verified"}], "external": false};
 window.dfnpanelData['ui-redressing'] = {"dfnID": "ui-redressing", "url": "#ui-redressing", "dfnText": "UI Redressing", "refSections": [{"refs": [{"id": "ref-for-ui-redressing"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-ui-redressing\u2460"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}], "external": false};
+window.dfnpanelData['recommended-range-and-default-for-a-webauthn-ceremony-timeout'] = {"dfnID": "recommended-range-and-default-for-a-webauthn-ceremony-timeout", "url": "#recommended-range-and-default-for-a-webauthn-ceremony-timeout", "dfnText": "recommended range and default for a WebAuthn ceremony timeout", "refSections": [{"refs": [{"id": "ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
 </script>
 <script>/* Boilerplate: script-dom-helper */
 function query(sel) { return document.querySelector(sel); }
